Based on your example (single) event, eventtype field should be extracted as multivalue field. You can try something like this. eventtype="UserAgent" AND tag::eventtype="OperatingSystem" | rex max_match=0 "eventtype=(?P<Value>(\w+\s+)*)(?<Name>[^\s]+)\s+Options" | eval temp=mvzip(Name,Value,"#") | mvexpand temp | rex field=temp "(?<Name>.*)#(?<Value>.*)" | fields - temp | where Name="Browser"| chart count by Value Change the filter 'where Name="Browser"' to "OperatingSystem' to get similar chart for Operating Systems. ... View more