I used the following to help with this at search time with key-value pairs that had space delimiters and = key delimiters: | extract pairdelim=" " kvdelim="=" This also works when your KV pairs optionally have quotation marks for data that contains whitespace.
... View more