Do these fields both exist in one event you have in splunk? If so here is my quick (definitely not the best) regex to extract the fields values ... | rex field=_raw ".*cvpEditAction.*\s:\s\"(?<cvpEditAction>.*)\".*\"cvpEditAllowedAmount.*\s:\s(?<cvpEditAllowedAmount>.*).*" And in your Splunk search Interesting Fields you should see cvpEditAction and cvpEditAllowedAmount ... View more

You can update a kv value by doing the same service.request() as you do for an insert but just modify the REST API call. Which is to add the _key for the record after your collection https ://< localhost >/..data/mycollction/keyID The only other thing you need to remember to do is make sure the record includes all your other key values, or else it will update those to empty var record = { "CustID": form_id, "CustName": form_name, "CustStreet": form_street, "CustCity": form_city, "CustState": form_state, "CustZip": form_zip }; var keyID = '5410be5441ba15298e4624d1' service.request( "storage/collections/data/mycollection/" + encodeURIComponent(keyID), "POST", null, null, JSON.stringify(record), {"Content-Type": "application/json"}, null); ... View more