It might "work" but it doesn't work properly. With this search you need to read every single event you have in your specified time range just to find the few matching ones. You need to a) Define proper extractions in Splunk's configuration or (even better; assuming your events _are_ well-formed jsons) b) Configure the sourcetype associated with this type of events to use KV_MODE=json ... View more