That seemed to do it. Thank you very much!  Here is the code and results: index = websphere_cct Object IN (" HJn8server3 (HJn8, UAT-230612150440)"," HJn5server1 (HJn5, PROD-230612151857)") SectionName | fields - _* | fields Object Attributes.* | eval Object = ltrim(Object, " ") | transpose column_name=Attribute header_field=Object | eval match = if('HJn8server3 (HJn8, UAT-230612150440)' == 'HJn5server1 (HJn5, PROD-230612151857)', "y", "n")   However, I am confused about how this code works.  Specifically, what the code "| fields - _*"   and "| eval match = if('HJn8server3 (HJn8, UAT-230612150440)' == 'HJn5server1 (HJn5, PROD-230612151857)', "y", "n")"  does? As I understand it,  "| fields - _*"  just eliminates the fields with an underscore? if('HJn8server3 (HJn8, UAT-230612150440)' == 'HJn5server1 (HJn5, PROD-230612151857)', "y", "n")"  I would think compares two "Object" fields. Can you please explain?   Thank you.    ... View more

Thank you for the reply and pointing out my JSON format is incorrect. I will start with that. Per the events that I ingest, I did not show the raw data. The raw data looks as such { "Object":" HJn6server1 (HJn6, PROD-230612151857)","Env":"PROD","SectionName":"JVM Arguments", "Attributes":{"genericJvmArguments": "-Djava.awt.headless=true -server -Xdump:system:none -javaagent:D:\\AppDynamics\\AppServerAgent\\javaagent.jar -Dappdynamics.agent.nodeName=${WAS_SERVER_NAME}","-DFileNet.Content.DownloadServerAffinityEnabled": "TRUE","-DFileNet.Content.GetBlockSizeKB": "4096","-DFileNet.Content.PutBlockSizeKB": "4096","-DFileNet.Content.UploadServerAffinityEnabled": "TRUE","-DFileNet.WSI.AutoDetectLTPAToken": "is not set","-Dappdynamics.agent.applicationName": "is not set","-Dappdynamics.agent.nodeName": "${WAS_SERVER_NAME}","-Dcom.filenet.authentication.token.userid": "is not set","-Dcom.filenet.authentication.wsi.AutoDetectAuthToken": "is not set","-Dcom.filenet.repositoryconfig.allowWSIOnWAS": "is not set","-Dcom.ibm.mq.cfg.jmqi.UnmappableCharacterAction": "is not set","-Dcom.ibm.mq.cfg.jmqi.UnmappableCharacterReplacement": "is not set","-Dfilenet.pchconfig": "is not set","-Djava.awt.headless": "TRUE","-Djava.security.auth.login.config": "is not set","-Djaxws.payload.highFidelity": "is not set","-Xdump": "system:none","-Xgcpolicy": "is not set","-Xmn2048M": "is not set","-Xmn512M": "is not set","-Xquickstart": "is not set","-Xverbosegclog": "is not set","-javaagent": "D:\\AppDynamics\\AppServerAgent\\javaagent.jar","-server": "is set","": ""}} From what you stated, the field "Attributes" should read: { "Attributes": ":\n-DFileNet.Content.DownloadServerAffinityEnabled: TRUE\n-DFileNet.Content.GetBlockSizeKB: 4096\n-DFileNet.Content.PutBlockSizeKB: 4096\n-DFileNet.Content.UploadServerAffinityEnabled: TRUE\n-DFileNet.WSI.AutoDetectLTPAToken: is not set\n-Dappdynamics.agent.applicationName: is not set\n-Dappdynamics.agent.nodeName: is not set\n-Dcom.filenet.authentication.token.userid: is not set\n-Dcom.filenet.authentication.wsi.AutoDetectAuthToken: is not set\n-Dcom.filenet.repositoryconfig.allowWSIOnWAS: is not set\n-Dcom.ibm.mq.cfg.jmqi.UnmappableCharacterAction: is not set\n-Dcom.ibm.mq.cfg.jmqi.UnmappableCharacterReplacement: is not set\n-Dfilenet.pchconfig: is not set\n-Djava.awt.headless: TRUE\n-Djava.security.auth.login.config: ${USER_DIR}/DocumentRepository/jaas.conf.WebSphere\n-Djaxws.payload.highFidelity: is not set\n-Xdump: system:none\n-Xgcpolicy: is not set\n-Xmn2048M: is not set\n-Xmn512M: is not set\n-Xquickstart: is set\n-Xverbosegclog: is not set\n-javaagent: is not set\n-server: is set\ngenericJvmArguments: -Xgcpolicy:gencon\n-Djaxws.payload.highFidelity=true -Dfilenet.pchconfig=${USER_DIR}\\HJIPDash\\PchConfig.properties -Xmn512M -Dcom.filenet.authentication.token.userid=sso:ltpa -DFileNet.WSI.AutoDetectLTPAToken=true -Dcom.filenet.authentication.wsi.AutoDetectAuthToken=true -Dcom.filenet.repositoryconfig.allowWSIOnWAS=true -DFileNet.Content.PutBlockSizeKB=10240 -DFileNet.Content.GetBlockSizeKB=10240", Please affirm. As for "traverse the Attributes field" , I want to compare the Attributes of one Application Server to another Application Server.  My results table would look something like this:   Config Matches (y/n)? HJn6server1 (HJn6, PROD-230612151857) HJn3server1 (HJn3, PROD-230612151857) As for my code, I am not certain of what you are asking. The dashboard I have looks as such:   The user selects an Environment/Application server pair twice, selects a Section then the dashboard shows a table (per above).       ... View more