Hi dhabbal, if your emails are in a field called "email", you could run a search like this: index=my_index | rex field=email "\@(?<domain>[^ ]*)" | stats dc(email) AS num_email BY domain in this way you have the count of different emails in your logs. If in addition you want also the name of your emails, you could run: index=my_index | rex field=email "\@(?<domain>[^ ]*)" | stats values(email) AS email dc(email) AS num_email BY domain If at least, you want the number of emails ordered by domain, you could run: index=my_index | stats count BY email | rex field=email "\@(?<domain>[^ ]*)" | sort domain | table domain email count Bye. Giuseppe ... View more