It appears to be Splunk default behavior to roll up data in that manner, I believe you may need to remove the empty (NULL) -if any, and OTHER field values from the display. Use: useother=f usenull=f in your SPL. ... View more