Query index=java networkenv=prod stackenv=prod source="/opt/jboss/standalone/custom_engine.log" |convert ctime(_time) as time timeformat="%m/%d/%Y %H:%M:%S" |rex field=_raw ""orderEnteredBy":\"(?[^\"]+\")" |table time orderEnteredBy It matches the word orderEnteredBy but when i tried to get the name into the table it shows empty.. Here is the log availableBalance":{},"projectedBalance":{}}},"productSummary":{"symbol":"RPACX","displayValue":"RPACX","cusip":"32254T759","assetType":"MUTUAL_FUND","description":"UFACRESCENT FUND N/L","settlementDuration":4,"omnibusProduct":true},"orderEnteredBy":"JANEDOE","orderUpdatedBy":"SYS_USER","dirtyFSTT":false,"messagesSummary":{"messagesCount":2,"errorsCount":0,"warningsCount":0,"infosCount":0},"assetType":"MUTUAL_FUND","fundServTransactionTypeDetails":{"cdscValueOverridable":false,"netAssetValue":"NAV_OTHER","rightsOfAccumulation":{"additionalHoldings":0,"manualOverride":false,"additionalHoldingsValid":true} ... View more