| makeresults | eval _raw="000 2 00 0000 2020-01-08 13:52:48.771 (PickupStatusListener:41) Message payload: <?xml version=\"1.0\" encoding=\"UTF-8\"?> <ns0:PickupStatus xmlns:ns0=\"http://cpc.ground.fedex.com/pickup/status/v1\"><CorrelationId>4dba36a5-076b-4dc6-bde5-04366a4dcb78</CorrelationId><MessageId>bf6cd527-fb0b-4f08-8920-f1c01d498764</MessageId><ParentMessageId>c4b3cc79-c4bb-4512-a3b7-f1527cf03491</ParentMessageId><StatusForMessageId>1570a3c5-fab3-4ad3-ad13-5ed883171712</StatusForMessageId><DateTime>2020-01-08T13:52:48.717-05:00</DateTime><SourceSentDateTime>2020-01-08T13:52:27-05:00</SourceSentDateTime><Status>ReadReceipt</Status><Message>Request to remove pickup from manifest was received by the scanner.</Message><UserId>BRK_APP</UserId><RequestType>TransferRequest</RequestType><Action>Remove</Action><TerminalNumber>314</TerminalNumber></ns0:PickupStatus>" | rex "(?<xml_data>(?=\<).+)" | rex "(?<time>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d{3})" | spath input=xml_data | fields - _* xml_data | eval _time=strptime(time,"%F %T.%3Q") Hi, @timothytruax If there is data in _raw , it can be extracted like this. ... View more

OK, be sure to click Accept to close the question. ... View more

Try something like this (index=index1 other parts ) OR (index=index2 other parts) | eval itemCode=coalesce(item1,item2) | stats dc(index) as reportedBy by itemCode | stats count as Count by reportedBy | eventstats sum(Count) as Total | eval Percent=round(Count*100/Total,2) | eval ItemType=if(reportedBy=2,"Common in Both Indexes","Unique in Both Indexes") | table ItemType Count Percent ... View more

Absolutely!! Thanks again. I'm new to this and I am upvoting it now. ... View more