Hi You can configure your file $SPLUNK_HOME/etc/apps//local/props.conf like this: [REPORT-Something] DELIMS = " " (with a space inside) FIELDS = "filedname1","filedname2","filedname3" Make sure you restart splunk after change the file, then you can get the keys by split with "=". ... View more