@gibba If I could give you a million splunk points for this answer, I would. I've been working on this issue for well over an hour and this is the only thing that worked for me. This is VERY unclear in the docs. ... View more