It can actually, just has to be a field. In your case, you might try spath input=_raw. which is the default, not sure why it's not working e.g. Event: blah=monkeys json_field={"foo":"5022","bar":"d062"} quack=typewriter search monkeys | spath input=json_field Will give you foo=5022 and bar=d062 So you could write a regex like rex field=_raw "(?<json_field>{.+})" ^might need {.+} Which should throw everything from the first { to the last } into field json_field good luck edit: http://splunk-base.splunk.com/answers/61235/kv_modejson-with-combined-json-textual-loglines same thing ... View more