Thank you for replying - however I am not at this point doing a search. I am trying to extract fields. More specifically, My sample selection of data contains the following data 2017-08-17 10.0.3.40 200 200 "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" Most of the line (event) contains data separated by spaces, but as you can see, there is one field that also includes spaces, but is inside quotes. I need Splunk to see this as one field, which will be called "UserAgent" (which later could be part of a search criteria). ... View more