I would only suggest a change in the query. change this line | eval temp=split(n,"}") by | eval temp=split(n,"},"). So when assembling a graph, for example, it avoids adding an empty column, for example. Just to clarify, this query saved me, thank you very much. ... View more