@alpsplunkuser I didn't need the kvdelim to get it to break into key value pairs in this example, but I don't have your data, so YMMV. I think the command you're looking for is untable . To use it in this run anywhere example below, I added a column I don't care about. Then untable it, to get the columns you want. Then use table to get rid of the column I don't want, leaving exactly what you were looking for. | noop | stats count | eval _raw="Whatisthis=donotcare, status=BLOCKED, identifier=123422dsd13, userId=12344, name=John" | extract pairdelim=", " | untable Whatisthis Key Value | table Key Value https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Untable ... View more