Hello Mus, i think i'm the latest guy ever to this party.   I don't think i got the point here, so if we create our field extraction (regular expression) trough the UI, it would be a EXTRACTION option configured right ?  I have created my field in the same way that romanwaldecker did, and got the same name for my extraction: my_sourcetype : EXTRACT-MYFIELD but, when I try to do a search  <your base search> | extract MYFIELD  it keeps getting me these error: Error in 'extract' command: Failed to parse the key-value pair configuration for transform 'MYFIELD'. Do you possibly have in mind what it could be ? I'm kinda trapped on it for a few days ... View more