This is similar to this question . You can do what you need by using REPORT in props.conf and transforms.conf to define the extraction rule, e.g. props.conf [sourcetype] ... REPORT-xyz = perfmon-vals transforms.conf [perfmon-vals] REGEX = ,(\d+) MV_ADD = true ... View more