Hi @deepasha1989  Splunk HEC is one of the interface to ingest logs to Splunk. Having said that it doesn't do any pre-process of payload that you send. What you send via HEC is exactly what you will find in Splunk search. If you want in a format that you are expecting you shall pre-process payload the format you want and send it.  Other approach is to ingest the original payload with single attribute message: , data: etc and post-process it during the search-time. However that would be a complex process and extra overhead in Search UI depends on size of payload and logic that you will apply, you can test upfront in search UI using | makeresults command if the logic you intent to write really works then decide. --- An upvote would be appreciated and Accept solution if this reply helps! ... View more