Ive worked out how to do the first part source="*reportingservice.log.json" User.OrganizationId=* | mvexpand Request.Body.SelectedColumns{}.ColumnId | rename Request.Body.SelectedColumns{}.ColumnId as ColumnId | stats count(ColumnId) as count by ColumnId | table ColumnId, count | sort -count And the second part source="*reportingservice.log.json" User.OrganizationId=* | mvexpand Request.Body.SelectedColumns{}.ColumnId | rename Request.Body.SelectedColumns{}.ColumnId as ColumnId | stats avg(Metrics.ResponseTime) as responsetime by ColumnId | table ColumnId, responsetime | sort -responsetime ... View more