@ITWhisperer    Thank you so much .. its working.. but PackageStatus is empty even if has value  if other columns Packagecode,PleaseResend,amount are empty..  Do we have any condition to display Packagestatus values if not empty even if other fields present or not present.   Please find the below screenshot and logs with all fields present and some with only packagestatus in commentText Section.     Event logs scenario 1 with all fields in commentText: Payload:{\"comments\":[{\"isActive\":true,\"sendToGSR\":false,\"confidential\":false,\"profileId\":197229,\"profileCode\":null,\"commentId\":null,\"commentText\"😕"Value card from package was successfully issued but no Guest email was provided, please resend - N/A, Package code - PC0J0 , For amount - $476.0\",\"commentType\":null,\"commentLevelEnum\"😕"TC\",\"externalReferences\":[{\"referenceType\"😕"TC\",\"referenceValue\":1844634700}],\"auditDetails\":null}]} Scenario 2 without packagecode,amount,please resend fields in commentText: Payload:{\"comments\":[{\"isActive\":true,\"sendToGSR\":false,\"confidential\":false,\"profileId\":197230,\"profileCode\":null,\"commentId\":null,\"commentText\"😕"Value card from package was unsuccessful in issuing - Generic Email Error\",\"commentType\":null,\"commentLevelEnum\"😕"TC\",\"externalReferences\":[{\"referenceType\"😕"TC\",\"referenceValue\":1844634026}],\"auditDetails\":null}]}   Scenario 3: All fields are present in commentText except 'Please Resend' field   Payload:{\"comments\":[{\"isActive\":true,\"sendToGSR\":false,\"confidential\":false,\"profileId\":197228,\"profileCode\":null,\"commentId\":null,\"commentText\"😕"Value card from package was successfully sent to Guest’s email - WDP************************, Package code - PC0J0 , For amount - $476.0\",\"commentType\":null,\"commentLevelEnum\"😕"TC\",\"externalReferences\":[{\"referenceType\"😕"TC\",\"referenceValue\":1843819496}],\"auditDetails\":null}]}   Finally, i want to display all the column values which are present and other columns as empty if they are not present in event logs ... View more

@ITWhisperer  ... View more

i have tried still no luck..   ... View more

Thanks @ITWhisperer  for the solution.. but still showing empty rows but there is no error . The query is working but somewhere i have missed something its not displaying data. its showing empty rows as given in the screenshot. Do we need to change any settings in splunk table? ..iam working on splunk for first time.   ... View more