Thanks for your help. infact there was multiple challenges was there which was like after extracting field some more data was need to be extracted in multiple line.I managed to get it solved by using "rex " and "(?m)" search command. ... View more

Sounds like you might be peeking at the Data Summary button on a blank Search screen. If I remember correctly, that is going to show details on the indexes your ID searches by default. Since you likely need to put index=os into a search to get that data, it won't appear on that table. You can workaround this though, that table just runs the metadata command, so you could take a step into your Splunk Ninja training by trying your hand at: | metadata index=* type=sourcetypes Learn more at Search Reference: metadata ... View more