If you want to do this as a search-time KV extraction, it would be very simple to use the following RegEx to separate your KV pairs: PROPS.CONF: [mysourcetype] REPORT-mysourcetype = xf-kv TRANSFORMS.CONF: [xf-kv] REGEX = (?<_KEY_1>[^ ]+):(\[\d+\])?\s"(?<_VAL_1>[^ ]+)" This will yield the following fields, based on your sample data, above: LENGTH = 353 SESSIONID = 5544703 ENTRYID = 1 This removes the [count], the quotes, and enumerates the fields in a very simple way. HTH Ron ... View more