Hi  Your case should end with ,1=1, 100) and not 1==1,100 ... View more

OR run <splunkweb>/en-US/debug/refresh ... View more

Thank you for your reply  ... View more

Used this to find the HF's  | set diff [search earliest="-30m" index=_internal host="*-splunk-hf" | dedup host | table host] [search earliest="-10m" index=_internal host="*-splunk-hf" | dedup host | table host] ... View more