Ehhh... There are several things wrong here. Firstly, you should onboard your data properly. For now you think you're having problems with field extractions but you should make sure that: 1) Your data is properly split into separate events 2) Your timestamp is properly recognized 3) Your fields are properly extracted (in this case they most probably be extracted using regexes by anchoring them to known "tags" like your <ref> string) Additionally, unless you absolutely can't avoid it, you should never use wildcards at the beginning of your search term and avoid using them in the middle of your search term due to performance reasons and consistency of the results. In your case the wildcard is in the middle of the search term but due to it being surrounded by major breakers (the pointy braces) it will be treated as a beginning of a search term. That's a very very bad idea because Splunk has to read all the events you have and can't limit itself to only find events using the indexes it built from parts of your events. So get your data onboarded properly and the search will be something like index=my_index my_ref=$Ref$* And that will be enough ... View more