You can override _raw and wipe out the old fields ... | rename empty as _raw | rename _raw as yourfield | extract pairdelim="[\r\n]+" kvdelim=":" a little more complicated is to keep the origraw and replace at end ... | eval origraw = _raw | rename empty as _raw | rename _raw as yourfield | extract pairdelim="[\r\n]+" kvdelim=":" | rename origraw as _raw ... View more

I downvoted this post because dosnt answer the question ... View more