Ok this is getting annoying. You've been told multiple times that your approach won't work.
Now, in your question you state that you're STILL using monitor (even though you've been told this won't work like you want it to), but in your comment you say you're using fschange. So, which one are you really using?
Also fschange has NOT been removed, it is just deprecated which means the functionality will not be developed further.
It seems to me you've skipped the step of learning the basics of what Splunk is and how it works. Please take the time to getting to know Splunk a bit, it will save you loads of time when you understand the proper way to solve different things, and it will also save the splunkbase community from frustration when repeatedly having to tell you the same thing.
