Thank you, my issue is there are about 50 + useful fields out of 250 odd total fields, this means my lookup need to be 50 files. I think it is better to do just replace command in search for the value in fields? ... View more

Splunk is doing correctly, coz field1, field10,field2 i correct ordering. The only way i could think of is to "pad" your field names with zeroes, so it becomes field001, field002,field003... , field010,field011.... field100,field101 etc Inroder to do that 1. Do it manually one time (may be easier here).=> Just put each field to do rename eg: |rename field1 as field001 and put as a macro . So your search should be . => ...| rename_my_fields | table field* 2. Do using some kind of regex to pad ....|foreach field* [eval newfield=<<FIELD>>] table field* ... View more

Thank you so much, that is what I have been looking for and did not find in answers or was not able to locate! ... View more