Hi Maries, Please try with the below search <your curl command> -d search= "search index=<indexname> | stats count as field1 | eval field1="dallvcflwb110u,yes;dallvcflwb120u,yes" | eval field1=split(field1,";") | mvexpand field1 | rex field=field1 \"(?<host>.*),(?<mode>.*)\" | table host mode | outputlookup atlassian_maintenance.csv" ... View more

hi @Maries  It would be wise to take help from Splunk professional services and AWS to do this activity.  Especially for managing data, avoiding loss of data, duplication of events and above all data integrity. Do also consider the security, compliance and regulatory requirements for the company.  ... View more