check this one.. index=main sourcetype=jmslogs | rex field=_raw "(?ms)^\s+(?P\d+\-\d+\-\d+\s+\d+:\d+:\d+,\d+) INFO \[(?P[^\]]+)" | table jmsContainer date _raw jmsContainer date _raw jmsContainer-2 2016-08-03 23:32:07,551 2016-08-03 23:32:07,551 INFO [jmsContainer-2] ... jmsContainer-15 2016-08-03 23:43:06,660 2016-08-03 23:43:06,660 INFO [jmsContainer-15] ... jmsContainer-1 2016-08-03 23:20:06,581 2016-08-03 23:20:06,581 INFO [jmsContainer-1] ... jmsContainer-10 2016-08-03 23:39:06,123 2016-08-03 23:39:06,123 INFO [jmsContainer-10] ... jmsContainer-1 2016-08-03 23:31:06,453 2016-08-03 23:31:06,453 INFO [jmsContainer-1] ... jmsContainer-5 2016-08-03 23:51:00,607 2016-08-03 23:51:00,607 INFO [jmsContainer-5] ... ... View more