Thank you! After playing with the transpose command this morning, I came up with this: index=f5_tstream source="f5.telemetry" telemetryEventCategory=systemInfo | stats latest(sslCerts.*.expirationDate) | transpose | rename column AS Certificate "row 1" AS "Expiration" | sort Expiration | eval Expiration=strftime(Expiration, "%m/%d/%Y") | eval Certificate=replace (Certificate, "latest\(sslCerts.", "") | eval Certificate=replace (Certificate, ".expirationDate\)", "") This gets the Unix time for all fields containing "latest(sslCerts.*.expirationDate)" and puts them in a table with the certificate name, sorts by expiration date, then translates the Unix time to m/d/y, then gets rid of the useless text at the beginning and end of the certificate name fields. This made my results populate in a table like this: Certificate_Name#1 8/8/2022 Certificate_Name#2 9/9/2022 Certificate_Name#3 10/10/2022
... View more
