Hi frbuser ,uhaq,gcusello,DavidHourani Where you able to get a optimized approach?,Im also searching for a solution to optimize rather than search with * . eg ..category=Blogs,Software/Technology,Malware,Block List,Computer Security i want to search if only malware is available as a substring Im using this SPL -->index=abc category="*malware*"| stats count by category Can i make it more optimized? Thanks in Advance. Jbz
... View more