Hi for me it seems to work as @smurf suggested with your test data. See below | makeresults
| eval _raw = "2023-08-08 10:25:48.407 [INFO ] [Thread-3] CollateralProcessor - compareCollateralStatsData : statisticData: StatisticData [selectedDataSet=0, rejectedDataSet=0, totalOutputRecords=0, totalInputRecords=0, fileSequenceNum=0, fileHeaderBusDt=null, busDt=08/06/2023, fileName=SETTLEMENT_TRANSFORM_COLLATERAL_LENDING, totalAchCurrOutstBalAmt=2.722379487286E10, totalAchBalLastStmtAmt=2.722379487286E10, totalClosingBal=2.722379487286E10, sourceName=null, version=0, associationStats={}] with collateralSum 2.722379487286E10 openingBal 2.73215647389E10 ageBalTot 2.722379487286E10 busDt 08/07/2023 with prevStatisticData null
2023-08-09 10:31:57.834 [INFO ] [Thread-3] CollateralProcessor - compareCollateralStatsData : statisticData: StatisticData [selectedDataSet=0, rejectedDataSet=0, totalOutputRecords=0, totalInputRecords=0, fileSequenceNum=0, fileHeaderBusDt=null, busDt=08/07/2023, fileName=SETTLEMENT_TRANSFORM_COLLATERAL_LENDING, totalAchCurrOutstBalAmt=2.71092692285E10, totalAchBalLastStmtAmt=2.71092692285E10, totalClosingBal=2.71092692285E10, sourceName=null, version=0, associationStats={}] with collateralSum 2.71092692285E10 openingBal 2.722379487286E10 ageBalTot 2.71092692285E10 busDt 08/08/2023 with prevStatisticData null"
| multikv noheader=t
```previous make test events```
| rex "busDt=(?<busDt>.*?),\sfileName=(?<fileName>.+?),.*collateralSum\s(?<collateralSum>[\d|\.|E]+)\sopeningBal\s(?<openingBal>[\d|\.|E]+)\sageBalTot\s(?<ageBalTot>[\d|\.|E]+)"
| table busDt fileName collateralSum openingBal ageBalTot This shows those two events with required fields. Works even you change that regex to | rex "busDt=(?<busDt>.*?),\sfileName=(?<fileName>.+?),.*collateralSum\s(?<collateralSum>[\d\.E]+)\sopeningBal\s(?<openingBal>[\d\.E]+)\sageBalTot\s(?<ageBalTot>[\d\.E]+)" You shouldn't use "|" as a separator inside "[]". r. Ismo
... View more