I'm trying to ingest airwatch syslog events but not all fields are searchable only those with Field=Value in the message are searchable. The logs contain two different kv formats in the syslog events, those with Field: Value and Field=Value . In the first half of the message the values run into the next field name which I believe is the part that Splunk is having trouble with. In my example the first kv pair is Event Type: Console with my field extractions in place the fields and values appear correct, however searching for EventType=Console yields no results. I've implemented regex extractions via inline extractions as a single field extraction with capture groups per field and each field as a separate extraction. I tried using delimiters via the field extraction wizard, this allows me to search like normal but the values include the next field name just like the logs, it requires regex or something further to tell Splunk where the value should end. I figured I'm missing something here, just not sure if using regex for field extractions this way is correct if there's some other piece that is required when using regex for search-time field extractions. Mar 9 13:52:33 10.0.2.24 March 09 19:52:33 AirWatch AirWatch Syslog Details are as follows Event Type: ConsoleEvent: DeviceDataModfiedUser: domain\JoeUser Source: ServerEvent Module: DashboardEvent Category: DeviceEvent Data: Device=User iPhone iOS 10.2.1 X0XX;DeviceData=OwnerGroup;LoginSessionID=xx1xxx0xxxxx my greedy regex. EXTRACT-Device = Device=(?P<Device>[^ ]+); EXTRACT-DeviceData = DeviceData=(?P<DeviceData>[^ ]+); EXTRACT-Event = Event:\s+(?P<Event>\w+)User EXTRACT-EventCategory = Category:\s+(?P<EventCategory>\w+)Event EXTRACT-EventModule = Module:\s+(?P<EventModule>\w+)Event EXTRACT-EventType = Event Type:\s(?P<EventType>\S+)Event EXTRACT-User = User:\s+(?P<User>[^ ]+)Event EXTRACT-EventSource = Source:\s+(?P<EventSource>\w+)Event ... View more