Use the power of foreach to loop through the different fields, combined with | eval {a}=b syntax to create a field whose name is the value of  a and value is the value of b.   Here is my search. As all my problem fields had spaces in them, I aimed foreach just at field names with spaces ("* *").   This copy has comments to explain each part, and the one below is comment-free:   ``` in every event/result row, loop over all field names with spaces in them ``` | foreach "* *" [ ``` create a temporary string with the name of the field to be renamed ``` eval x="<<FIELD>>", ``` tidy up the field name by doing string substitution - put any regular expression in the center. (This one drops all characters that are not spaces or in Splunk's set of allowable characters.) First it does a regex replace, then trims leading/trailing spaces, then replaces all remaining spaces with underscores ``` y=replace(trim(replace(x, "[^A-Za-z0-9_ ]", "")), " ", "_"), ``` create a new field with the tidied name and the value of the original - use single quotes because <<FIELD>> has spaces and special characters, and we need to get its value (single quotes), not its name (double quotes). ``` {y}='<<FIELD>>' ``` remove the temporary fields and the poorly-named original field ``` | fields - x y "<<FIELD>>" ]     Clean version:   | foreach "* *" [ eval x="<<FIELD>>", y=replace(trim(replace(x, "[^A-Za-z0-9_ ]", "")), " ", "_"), {y}='<<FIELD>>' | fields - x y "<<FIELD>>" ]     Another improvement/variant you can do is: before running the inner "replace all special characters with nothing", you could "replace all dot and dash to underscore" - then continue with the rest as written.   ... View more

Yes, you can use rex and multivalued fields to select new "raw" texts and expand them into new events. The fun is getting the regular expression right so you can use it like LINE_BREAKER. Here I am using a few things: (?sm) -- s for "dot-all", so .*? matches newlines, and m for multiline, so ^ matches the beginning of a line instead of the beginning of an event \d\d\.\d\d\.\d\d\s -- this would be the unique string, appearing in LINE_BREAKER after the () capturing group (space between events), that shows a new event is starting .*? -- get the rest of the content for that event ((?=[\r\n]+\d\d\.\d\d\.\d\d\s)|(?!.)) -- this says collect content... until you find a spot that, after it, comes a newline followed by the above unique string. This means the event is ending. But, put an OR in there, because the last event won't have another event after it - so don't match anything. Here is the full search string: | rex field=_raw max_match=99 "(?sm)^(?<raw>\d\d\.\d\d\.\d\d\s.*?)((?=[\r\n]+\d\d\.\d\d\.\d\d\s)|(?!.))" | mvexpand raw | rename raw as _raw Note: this only breaks up the raw text. Only up to 99 events will be extracted. Timestamps, field extractions, and event types will not be calculated from the "new" events. ... View more

Figured it out. Maintenance mode is listed as 0 (disabled) or 1 (enabled) in: $ ./splunk list peer-info slave base_generation_id:345 is_registered:1 last_heartbeat_attempt:0 maintenance_mode:1 restart_state:NoRestart site:default status:Up ... View more