Hi @ryanksplunkster , Your problem will be solved by using regex provided by @gcusello . This is just for better practice and suggestions. If you can properly format your JSON and ingest the data, Splunk will automatically extract all the fields. And by using spath command you can group json elements and extract the required values without writing regex. I have formatted your json sample data - https://jsonblob.com/d8185020-06e9-11ea-b8b2-d99444fde766 In this case, the activity can be easily extracted by appending | spath output=ACTIVITY_FIELDS path=activity to your query. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath ... View more