I'm not exactly sure how things are parsed out for you already, but I think you can get at this with rex...but might not be best solution. [your base search] | rex "\"fieldD\":{(?<my_field_d>[^}]+)" | rex max_match=0 field=my_field_d "\"(?<my_field_d>[^\"]+)\":" | eval my_field_d = mvjoin(my_field_d,";") So essentially, use rex to put all of fieldD in a field, then use rex again to grab all of the keys from there, which will create a multi-value field. So then use mvjoin to put them into a single value. So now each event would have a field of those keys concatenated together with semi-colons. ... View more