Hi JGP, You can create your own custom sourcetype to parse the events separately. Let me give you an example : My Sample Data - Test ID,name 1,test1 2,test2 Test ID,name 3,test3 4,test4 Test ID,name 5,test5 6,test6 My Sourcetype configuration - [test_csv] LINE_BREAKER=(\n+)Test SHOULD_LINEMERGE=true NOTE - You can define the other parameters as per your need. This is how it parses the data : If you want to extract fields, You can write your own REGEX to do it. Here is how I did it using "REX" command. Just to showcase : The query : source="testing.csv" host="so1" index="test_csv" sourcetype="test_csv" | rex "(?<Test_ID>\d+),(?<name>.*)" max_match=0 | table Test_ID,name Hope this helps. Thanks.
... View more