Please illustrate full message. The look of the fragment suggest your source is actually JSON, something like {"message":"journey::cook_client: fan: 0, auger: 0, glow_v: 36, glow: false, fuel: 0...
See more...
Please illustrate full message. The look of the fragment suggest your source is actually JSON, something like {"message":"journey::cook_client: fan: 0, auger: 0, glow_v: 36, glow: false, fuel: 0, cavity_temp: 257", "foo":"bar"} Is this correct? Using regex directly on structured data is strongly discouraged as any regex is doomed to be fragile. If the JSON is raw event, Splunk would have already extracted a field called "message". Start from this field instead. This field also is structured as KV pairs. Use kv aka extract instead of regex. | rename _raw as temp, message as _raw
| kv kvdelim=": " pairdelim=","
| rename _raw as message, temp as _raw
| fields fuel Your sample data would have given fuel _raw _time 0 {"message":"journey::cook_client: fan: 0, auger: 0, glow_v: 36, glow: false, fuel: 0, cavity_temp: 257", "foo":"bar"} 2024-07-17 09:06:35 Here is an emulation for you to play with and compare with real data | makeresults
| eval _raw = "{\"message\":\"journey::cook_client: fan: 0, auger: 0, glow_v: 36, glow: false, fuel: 0, cavity_temp: 257\", \"foo\":\"bar\"}"
| spath
``` data emulation above ```