Thank you. That removed the error but iwhat im seeing now is new fields/columns and blank spaces. Im not sure but i hope this paste will give you an idea of what im seeing. JobId BundleCode BundleCodeDescription BundleUrl DateTime Event Job Queued Time Job Started Time P&P Duration Production ID PublishedLocation Variant Completed Time Variant Started Time VariantDescription VariantId date_hour date_mday date_minute date_month date_second date_wday date_year date_zone host index linecount source sourcetype splunk_server statusValue timeendpos timestartpos 0104523B-2144-404A-85B0-E342C023F60C 2015-08-04T20:53:18 2015-08-04T20:53:19 JobProcessStarted JobQueued 2015-08-04T20:53:18 2015-08-04T20:53:19 20 4 53 august 18 19 tuesday 2015 local LL-000-00 main 1 JSON Completed 52 60 33 41 ... View more

Nice one! Just added a little extra to output Duration in h:m:s instead of seconds eval Duration=strptime(VariantProcessCompleted,"%Y-%m-%dT%H:%M:%S") -strptime(JobProcessStarted,"%Y-%m-%dT%H:%M:%S") | eval Duration=strftime(Duration,"%H:%M:%S") Thanks very much for your help! ... View more