hi - Got it now and applied the code below to your fresh sample. i checked the results and it looks ok.try this - |eval x=split(_raw,";")|mvexpand x|eval flg=if(like(x, "CommandType%"), "yes", "no")| where flg="yes"|rex field=x "(?<cmdtype>.*?)_"|rex field=x "success=(?<success>.*)"|streamstats current=f window=1 last(cmdtype) as prev_cmdtype,last(success) as prev_success |rex field=x "time=(?<avg>.*)"|where prev_cmdtype=cmdtype|rename prev_success as Success,avg as Average | fields - x, - flg, - prev_cmdtype, - success | stats count(cmdtype),avg(Average),median(Average) by cmdtype| rename cmdtype as "Command Type",count(cmdtype) as Total, avg(Average) as Average,median(Average) as Median ... View more