Good Morning! (or whatever time of day it is where you are). I actually found the answer after I delved a bit deeper into some other related Splunk Answers posts - I didn't realize that the file also needed to be updated on the indexers. Once it was updated, the search returned with the expected [correct] results. ... View more