Hi, I am trying to group (bring together) the results by a keyword in a certain field. For example, I want to group all of the URLs that include "Hightail". As you can see from the screenshot I have several Hightail URLs. I want to group them all together, and turn the results in to a dashboard. Would this be possible? Current query: index=proxy sourcetype=bluecoat cs_categories="*File Storage*" cs_username!="-" cs_method!="unknown" cs_host="*hightail*" | stats sum(cs_bytes) AS bytes_uploaded sum(sc_bytes) AS bytes_downloaded by cs_username cs_host sc_filter_result | eval megabytes_down=bytes_downloaded/1024/1024 | eval megabytes_up=bytes_uploaded/1024/1024 | rename cs_username as "User",cs_host as "Cloud storage URL", sc_filter_result AS "Result", megabytes_up as "Downloaded (MB)", megabytes_down as "Uploaded (MB)"| ......... replace OBSERVED with ALLOWED in Result | sort by -"Downloaded (MB)" | table User, displayName, department, Result, "Cloud storage URL", "Downloaded (MB)", "Uploaded (MB)" Thank you ... View more