You either need to ask in appropriate app forums or illustrate data sets available in Splunk (anonymize as needed), illustrate what results are expected from the illustrated data, then explain how you arrive at the expected results from illustrated data without SPL.
This is a Splunk forum. No one has any knowledge about your data. In general, no one knows what your results should look like, either.
