@fsiemonssplunk  The appends in the second example  are just data setup and only relevant to showing the example. They would not be relevant in your real data search, as mentioned in my post. Only from the fillnull statement is what you need.   ... View more