Using sourcetype="localapache", extracting fields from the following event only recognizes somevalues but not somevalues2: ::1 - - 2014-10-03 16:10:27.444 Pacific Daylight Time 80 "GET /blah?wp={somevalues}&wp={somevalues2}&more={someother} HTTP/1.1" "-" 204 - "-" 1000 I'm doing the following: sourcetype="localapache" source=access "GET /blah" | fields + wp | rex fields = wp "{...(?<something>...}" | table wp, something Both the names of the pair is "wp". Is there any workaround for this? (Edited some formatting problems with amp,gt,lt, etc.) ... View more