if, by
I have a key named
ick=2c27194g-af5e-4f7d-9847-07cd5c4c70af
you mean that whole string is part of a raw event, you need
| regex "ick=([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})"
to pick it out.
If, on the other hand, you mean that you have a field named "ick" that Splunk populates with that value, but in raw events they are not in the form of "key=value", you need to follow the actual format.
if, by
I have a key named
ick=2c27194g-af5e-4f7d-9847-07cd5c4c70af
you mean that whole string is part of a raw event, you need
| regex "ick=([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})"
to pick it out.
If, on the other hand, you mean that you have a field named "ick" that Splunk populates with that value, but in raw events they are not in the form of "key=value", you need to follow the actual format.