The logs are coming from a Django application, and the sourcetype is set to the name of the application (as shown by | metasearch sourcetype=* command). This is how we are sending logs from the application logger.info('Carrier updates summary; message="The following updates message", user="john_doe", carrier_slug="example_carrier"') We are using below query for extraction ((host="*.prod.domain.com" "Carrier updates summary;") OR (index=prod_index_eks kub.pod_name="domain-*" log="*Carrier updates summary;*")) | eval message=coalesce(message, log) | table message I hope this provides some context about our logs. Apologies if it doesn’t — I’m still very new to Splunk. I really appreciate your help! ... View more