Sorry.. I don't know what you mean. You could just look for the file: string. So something like: | rex field=mystring "file:(?P<filelocation>[^<]*)" this just looks for "file:" and then grabs whatever comes after it. ... View more

.... | eval sequence=mvjoin(attr," ") try this ... View more