I have recently installed splunk 6, almost certain this worked fine in splunk 5... I have extracted a number of fields from one index into another using the "| collect index=events" function. Now I have the fields in the new index and the raw data contains the key values i expected, but they are not being auto extracted by splunk? I have also tested this with some other data which also doesn't extract, and turned on verbose mode. Example data: time="2013/06/06 15:15:15" data="test" seconddata="test2" 05/09/2013 23:45:39 +0100, info_search_time=1381837886.531, bytes=214, client_ip="192.168.0.1", company=test1, destination_ip="10.0.0.1", domain="example.com", method=GET, reason="Not Found", status=404, uri="/test-env" Question: Is there some global setting to turn on KV extraction? Otherwise is it something I have broken? Thanks, Michael ... View more