@user9025 Can you please try this? YOUR_SEARCH
| rex field=_raw "\"Client\":\s\"(?<Client>.+?)\""
| stats count by Client My Sample Search : | makeresults
| eval _raw="{\"d1\": \"EU\",\"sn\": \"sn\",\"entityType\": \"USER\",\"email\": \"test@gmail.com\",\"id\": [\"123\"],\"Client\": \"TEST\",\"time\": \"2020-01-01T01:01:01Z\",\"List\": [{\"Type\": \"Items1\",\"value\": \"-1\",\"match\": \"NO\"}]}"
| append
[| makeresults
| eval _raw="{\"d1\": \"JP\",\"sn\": \"sn\",\"type\": \"USER\",\"user\": \"test1@gmail.com\",\"id\": [\"123\"],\"source\": \"S1\",\"Client\": \"test_client\",\"initiate\": \"init_Name\",\"mode\": \"Test\",\"t1\": \"\",\"t2\": \"\",\"auto\": true,\"list\": [{\"type\": \"USER_DRAFTS_COUNT\",\"value\": \"-1\",\"creteria\": \"skip\"}]}"
]
| rex field=_raw "\"Client\":\s\"(?<Client>.+?)\""
| stats count by Client Thanks KV If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
... View more