Hi @sara  Can you provide an exampe of the events which are missing fields? Splunk Support will still usually assist where they can with issues like this if the data is being generated by your Splunk deployment, if the events missing fields are coming from outside of Splunk then I imagine we wont be able to help too much but if its generated within Splunk then support should help. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more