You can find some useful sample in below document, http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Spath And try like this, index= <your_own_search> | spath |rename Projects{}.Tasks{}.TaskDueDate AS x, Projects{}.ProjectName AS y, Projects{}.Tasks{}.TaskName AS z |eval joinfield = mvzip(x,mvzip(y,z)) |mvexpand joinfield |eval Name=mvindex(FirstName,0) +" "+mvindex(LastName,0) | eval spjoinfield = split(joinfield,",") | eval Date=mvindex(spjoinfield ,0) | eval ProjectName=mvindex(spjoinfield ,1)| eval TaskName=mvindex(spjoinfield ,2)|table Name ProjectName TaskName Date I hope this helps. ... View more

Try this. index=your_search |rex "^.*\\\(?P<filename>.*)$" ... View more

I downvoted this post because this post isn't a reply ... View more