Ok well im not sure if this is the right answer, but here is what i did to help me get around it.... not sure how efficient it is though: index=app_smpeng sourcetype=smpeng:spectrum:performance | head 1 | spath path=model-response-list.model-responses.model output=models | mvexpand models | eval _raw = models | spath | lookup spectrum_attributes.csv attribute as "attribute{@id}" OUTPUT description as attribute_description | table attribute* | fields - attribute-* | eval temp=mvzip(attribute_description, attribute,"=") | eval _raw = mvjoin(temp, ",") I then dump the result into a summary index. Data comes back like so: Model Name=SSPerformance,Condition=0,Model Handle=0x320000d,ArchMgr CPU Utilization=0.01499869663023355,ArchMgr MEM Proc Size=6.355070972273846E8,OS Mem Avail=3.048480768E9,OS Mem Total=8.254803968E9,OS Net Packet Read Errors=0.0,OS Net Packet Read=6.7992425643783285,OS Net Packet Write Errors=0.0,OS Net Packet Write=4.7994653395611735,OS Pages In=0,OS Pages Out=0,Search CPU Time Elapsed=0.0,Search Memory Used=0.0,Time Delta=10.001114,VNM Attr Bytes Read=2.7996881147440176,VNM Attr Bytes Write=2829.2848176713114,VNM Attr Read Calls=0.6999220286860044,VNM Attr Write Calls=0.09998886124085778,VNM Conn Bytes Recd=2875.379682703347,VNM Conn Bytes Sent=424.95266027364556,VNM Context Switch=8.09909776050948,VNM CPU Utilization=0.09165819895690372,VNM Disk Bytes Read=2.7996881147440176,VNM Disk Bytes Write=2829.2848176713114,VNM ICMP Requests=0.0,VNM ICMP Successes=0.0,VNM Mem Proc Size=6.595788799999496E8,VNM Net Bytes Read=2875.379682703347,VNM Net Bytes Write=424.95266027364556,VNM Notif Latency=0.0,VNM Notif Threads=-8.383655900952226E-15,VNM Poll Latency=1.4281955584776981E-11,VNM Poll Threads=0.06666668888690283,VNM Sigalarm=0.3999554449634311,VNM Sigio=1.0998774736494354,VNM SNMP Get Next Req=0.0,VNM SNMP Incoming Varbind=0.0,VNM SNMP Mult Get Req=0.0,VNM SNMP Nosuchname Resp=0.0,VNM SNMP Outgoing Varbind=0.0,VNM SNMP Readonly Resp=0.0,VNM SNMP Tot Req=0.0,VNM SNMP Tot Resp Bytes=0.0,VNM SNMP Tot Resp=0.0,VNM SNMP Trap Bytes=0.0,VNM SNMP Traps=0.0,VNM Timer Latency=-1.4077246065294874E-14,VNM Timer Threads=0.583333807735437 Which splunk easily parses as K=V pairs. ... View more