Yes, this is possible. I copy/pasted your small snippet of log and set up an ingestion into Splunk and extracted the fields you had identified (the field extraction might need some tweaking depending on your usage). Props.conf is as follows: [phonelog] DATETIME_CONFIG = LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Custom pulldown_type = true EXTRACT-transaction_id,user_id,state = ^[^\(\n]*\((?P<transaction_id>[^\)]+)[^:\n]*:\s+(?P<user_id>\w+)[^\(\n]*\((?P<state>\w+) One you have the data extraction you should be able to find the duration of calls with the transaction command. It will look something like: your_search | transaction state startswith="OffHook" endswith="OnHook" Hope that helps! ... View more