First, verify whether there is an unprintable character between "Question? No" and "If yes, Question?". If so, we will need to key on that to split the data. If not, then the next question is, are the question stems always exactly the same wording, or a small set of alternatives? In that case, we can use a rex to extract them to individual fields using a regex such as one of the following.... ...if you want the questions and answers each separate... | rex field=myfield "(?<Q1>Question\?)\s*(?<A1>.*?)(?<Q2>If yes, Question\?)\s*(?<A2>.*?)(?<Q3>Does this even do something\?)\s*(?<A3>.*?)(?<Q4>Is the event a false positive\?)\s*(?<A4>.*?)(?<Q5>Ticket number:)\s*(?<A5>.*?)(?<Q6>Source Unique Identifier \(UI\):)\s*(?<A6>.*?)(?<Q7>Alert trigger time:)\s*(?<A7>.*?)(?<Q8>Event start time:)\s*(?<A8>.*)" ...if you want each question and answer as a unit ... | rex field=myfield "(?<Q1>Question\?\s*.*?)(?<Q2>If yes, Question\?\s*.*?)(?<Q3>Does this even do something\?\s*.*?)(?<Q4>Is the event a false positive\?\s*.*?)(?<Q5>Ticket number:\s*.*?)(?<Q6>Source Unique Identifier \(UI\):\s*.*?)(?<Q7>Alert trigger time:\s*.*?)(?<Q8>Event start time:\s*.*)" ... View more