1) Field Extraction transforms.conf: [extract-metric] REGEX=(\S+):(\S+) FORMAT=$1::$2 props.conf: [mysourcetype] REPORT-metric=extract-metric Or, if you just want search-time results, skip all this and use the extract command as shown below. 2) Timechart Reporting If your metrics field names follow a pattern, you may be able to use wildcards. For example if they all start with 'metric_', you can do: | timechart avg(metric_*) In a real pinch, you can use this (rather ugly) method: sourcetype=whatever ... | fields + _time,_raw | extract pairdelim=" " kvdelim=: | timechart avg(*) First, filter out all fields except _raw and _time . Then use extract to add back the fields containing your metrics. Now you can use timechart avg(*) , since only your metrics fields remain to be matched by the wildcard. ... View more