@saibalabadra, please try to pipe the following eval and stats to your existing search: <yourCurrentSearch> | eval url_pattern=case(match(url,"abc\/xyz\/def\/uvw\/.*\/.*\/rst"),"abc/xyz/def/uvw/*/*/rst",match(url,"abc\/xyz\/.*\/uvw"),"abc/xyz/*/uvw") | stats sum(count) as Count by url_pattern Following is a run anywhere search based on sample data provided in the question | makeresults | eval data="abc/xyz/1000/uvw 1;abc/xyz/2000/uvw 1;abc/xyz/3000/uvw 1;abc/xyz/def/uvw/1234/a1b2c3d4/rst 1;abc/xyz/def/uvw/5678/e5f6g7h8/rst 1" | makemv data delim=";" | mvexpand data | makemv data delim=" " | eval url=mvindex(data,0), count=mvindex(data,1) | fields - _time data | eval url_pattern=case(match(url,"abc\/xyz\/def\/uvw\/.*\/.*\/rst"),"abc/xyz/def/uvw/*/*/rst",match(url,"abc\/xyz\/.*\/uvw"),"abc/xyz/*/uvw") | stats sum(count) as Count by url_pattern ... View more