If the number and names are arbitrary, and the names basically are values as well (saying "this measurement was taken on server X") then you should use @ankireddy007's answer, extracting both as a value and charting one value grouped by the other. In general you could have Splunk extract the field name as well in transforms.conf, but in this case that wouldn't be good practice because the field name is essentially a value, not a field name. ... View more