Another unique field to extract is the Operation performed: \:\s+[A-Z]+\s+(?<Operation>[*\s]+) You can test on a report with: | rex field=_raw "\:\s+[A-Z]+\s+(?<Operation>[*\s]+)" You can use the operation event results to narrow down on the type events you want to search. For the event message portion, you can use: (?ms)([A-Z].*\s-\s+(?<Message>.*) You can test on a report with: | rex field=_raw "(?ms)([A-Z].*\s-\s+(?<Message>.*)" (?ms) is used to display multiple lines of a message. Example would be Java messages.   Thanks, Joe ... View more

Thank you. Short and nice. 🙂 ... View more