Thanks so much! This is exactly what I was trying to achieve. Apologies about the wrongly formatted data, but your dummy data is correct. For wildcard, I meant a field name that appears multiple times but can have any number of different subfields (i.e. `wildcard_field.*`) but I wasn't sure if this was the correct terminology, but your answer does work exactly for this field. Thanks again for your answer. It solves my problem, and I have also learnt a bit more about searching in Splunk, which I really appreciate. 👍
... View more