Awsome, somesoni2. It couldn't have been easier 🙂 I was breaking my head trying to find the way to join both groupings, adding semicolons, pipes, not commas beacause I saw tht was used to separate fields, changing the order,... anything, but I never thought of the simplest solution: just join them with a space. I guess I'll have to find myself a guide for basic searches in Splunk 🙂
Thank you very much for the answer, somesoni2.
... View more