Hello all, I have a query which creates a table similar to the following:   | table S42DSN_0001 S42DSN_0010   The table populates data within the S42DSN_0001 column, but not the S42DSN_0010 column.   I've double checked that there is definitely data captured within that field by looking at the events. There are 20 similarly named fields using the format S42DSN_00## which are found within the raw event data. Only the first 8 return results using the above query. For example the following works fine:   | table S42DSN_0001 S42DSN_0002   Any thoughts on why this might be happening? I am wondering if events past iteration S42DSN_0008 are not considered interesting, so Splunk is leaving them out of the results? Oddly enough, if I change my time period to the past 30 days, and use S42DSN_0010=* as a search criteria, I receive some, but not all results within that column. Thanks in advance, Trevor ... View more

I would like to add all instances of a field within the same variable, named SynchronousExecution. Is there a better way to include all fields of the same type?     | eval QPACAWTE_0001 = if(isNull(QPACAWTE_0001), 0, QPACAWTE_0001) | eval QPACAWTE_0002 = if(isNull(QPACAWTE_0002), 0, QPACAWTE_0002) | eval QPACAWTE_0003 = if(isNull(QPACAWTE_0003), 0, QPACAWTE_0003) | eval QPACAWTE_0004 = if(isNull(QPACAWTE_0004), 0, QPACAWTE_0004) | eval QPACAWTE_0005 = if(isNull(QPACAWTE_0005), 0, QPACAWTE_0005) | eval SynchronousExecution = QPACAWTE_0001 + QPACAWTE_0002 + QPACAWTE_0003 + QPACAWTE_0004 + QPACAWTE_0005       Thanks ... View more