You can begin using rex command, one example is below <Your Base Search> | rex field=_raw "reset (?<UserName>.+) LDAP password" | table UserName _raw However, you should ideally perform the same using Interactive Field Extraction (IFX) through the Extract New Fields option through your Splunk Search screen. Refer to the documentation for Step By Step process. Two advantages would be 1) Splunk will generate/adjust regular expression based on your data/needs 2) Fields will persist as Knowledge Object hence can be reused. 3) You can override with your own regular expression. http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX ... View more