Hi, I would like to execute a search, where several non-overlapping time ranges are excluded. An exclusion time range is marked by a begin event ("Start exclude messages") and an end event ("End exclude messages") and is typically several minutes long. The number of exclusion ranges within the search time range is not defined in advance: it could be 0, or it could be many. What I have come up with so far works if there is, at most, one exclusion time range completely within the search time range. However, it does not work if there are several time ranges that should be excluded or if the beginning or end of the search time range lies within an exclusion time range (e.g. no "Start exclude messages" event within search time range): index=* <some search parameters> | eval startExcludeTime=[ search index=* "Start exclude messages" | eval time=_time| return $time ] | eval endExcludeTime=[ search index=* "End exclude messages" | eval time=_time| return $time ] | where _time < startExcludeTime OR _time > endExcludeTime I also tried using a transaction based subsearch which works great to determine the exclusion time ranges but I was again not able to figure out how to exclude multiple time ranges in the main search: index=* | transaction startswith="Start exclude messages" endswith="End exclude messages" | eval startExcludeTime=_time | eval endExcludeTime=startExcludeTime+duration Is there another way how to exclude multiple time ranges from a search? Any help would be highly appreciated. Thanks, hbacbs System: Splunk Enterprise Version: 7.2.0 ... View more