Hello, I have the following logs (1 line = 1 event): id=**10** from="**10.10.10.44**" id=10 ### whatever useless log ### id=**10** bind uid="**toto**" id=10 ### whatever useless log ### id=**20** from="**10.10.10.55**" id=20 ### whatever useless log ### id=**20** bind uid="**tata**" id=10 ### whatever useless log ### id=20 ### whatever useless log ### id=**30** from="**10.10.10.44**" id=30 ### whatever useless log ### id=**30** bind uid="**titi**" id=30 ### whatever useless log ### id=**30** bind uid="**toto**" id=30 ### whatever useless log ### id=20 ### whatever useless log ### This is the table result I want : uid from count toto 10.10.10.44 2 tata 10.10.10.55 1 titi 10.10.10.44 1 This is the search I use to get my result: (...) "bind uid" OR "from"| transaction id startswith="from" | mvexpand uid | stats count by uid,from I have exactly the result I want, but the search is VERY slow to perform. A lot of time is used to do the transaction. So how I can improve my search, or how I can use stats instead of transaction? Regards, ... View more