You can add following search time field extraction (using transforms) on your search head(s).
props.conf (on search head)
[YourSourceTypeGoesHere]
REPORT-extractFields = colon_separated_fields
transforms.conf(on search head)
[colon_separated_fields]
REGEX = (\w+)\:([^,\s]+)
FORMAT = $1:$2
This should extract your fields which are separated by colon, which you can use in the base search to filter ( index=foo sourucetype=YourSourcetype numEvents>0 )
If you want to do it inline in the search, do like this
index=foo sourucetype=YourSourcetype | extract pairdelim="," kvdelim=":" | where numEvents>0
... View more