See if this helps. | makeresults | eval _raw="2020-07-21T01:52:37+00:00 devicename=device1 | id=a522131 | date=2020-07-21T01:51:20 | name=peter | score=5 | action=read | randomfield1=nothingimportant | score=2 | action=read | score=2 | action=write | score=2 | action=write | randomfield2=nothingimportant" ```Above just creates test data``` | rex "\bname=(?<name>\w+)" | rex max_match=0 "score=(?<score>\d+)" | rex max_match=0 "action=(?<action>\w+)" | eval actions=mvzip(score, action, ":") | table name actions ... View more

Hi @fsiemons, Sorry the above answer didn't answer your question. I'm sure help is on the way! But, in the mean time,If you want to try to get some immediate help for your question, you should join the 5000+ Splunk users in our public Slack Community chat. People ask each other for immediate help on there daily. You can share your question/link to your post there to see if anyone can take a stab at it. You first have to request access through https://splk.it/slack Fill out the form, and once you receive the approval email from our Community Manager (usually the approval process may take a couple days), you can access Slack.com and ask for help in the #general channel. ... View more