Hi @hbarot, Can you please add below configuration in props.conf and check ?? EXTRACT-Value1 = Value=\"\[(?<Value1>.*)\]\" You can also check by executing below search. YOUR_SEARCH | rex field=_raw "Value=\"\[(?<Value1>.*)\]\"" | table _time Value1 Happy Splunking ... View more