hi @splunk_smart Thank you for posting on Splunk Answers. A couple things that will increase your chance of getting your question answered by the community: Your post title should be in the form of a question and should be worded as clearly as possible. When you post bulky statements in the post's title, it scares off users who might have otherwise helped you. While it is good that you posted some code in your query, it is essential to properly explain its context. The more that you explain your problem, the better chance you have of getting your question answered. Thanks again for contributing and I hope you get the help you need! ... View more