You can configure key-value extractions around colons as well using props.conf+transforms.conf, however I fear those may get confused by the colons in the From: and To: values. Consider setting up regex-based extractions if that confusion does happen. Here's a rough sketch of how colon-based key-value extractions might look for your sourcetype: props.conf [your_sourcetype] ... TRANSFORMS-colons = colons transforms.conf [colons] REGEX = (?<_KEY_1>\w+):\s+(?<_VAL_1>\S+) See http://docs.splunk.com/Documentation/Splunk/6.0.3/Admin/transformsconf for reference, search for "key". Note, I've made the assumption that values are a string of non-space characters due to laziness - your reality may be more complicated. ... View more