This question is a bit of a mess and I cannot make sense of it. Probably you should start over and be more clear. We usually do not care much about your existing SPL. What we REALLY care about is CLEAR SAMPLE DATA (preferably with generation SPL, like I show below) and CLEAR DESIRED OUTPUT. It looks VERY much like your data is being sent in wrong and that each current event is actually multiple events. You should reindex it and break up these event clumps into single events. If the problem is that each clumped event lacks a correlation ID (so if you split them, the relationship is lost), then you should take a look at cribl because it has a feature to do this. You can contact me directly because that discussion is more complicated than we can do here. In any case, here is what I have for a start: | makeresults
| eval _raw="
2023-03-31 05:14:16,447 - __main__ - INFO - {\"Id\": \"123456JKL\", \"Table1\": \"employee\", \"Time1\": \"3.04\"}"
| append [| makeresults
| eval _raw="2023-03-31 05:14:16,393 - __main__ - INFO - {\"Id\": \"123456JKL\", \"Table2\": \"salary\", \"Time2\": \"4.05\"}"]
| append [| makeresults
| eval _raw="
2023-03-31 05:20:16,393 - __main__ - INFO - {\"Id\": \"123456JKL\", \"Table3\": \"salary1\",\"PayLoad\": {\\\"type\\\":\\\"test\\\",\\\"name\\\":\\\"jas\\\"}"]
| eval _time = strptime(_raw, "%Y-%m-%d %H:%M:%S,%3N")
| kv pairdelim="{,}" kvdelim=":"
... View more
