HI @pglover12, you have to identify the words to use for data classification and use them, e.g.: error: error, panic, critical authentication: login, logout, logfail etc... your-search
| eval type=case(searchmatch("error","error", searchmatch("panic","error", searchmatch("critical","error", searchmatch("login","authentication", searchmatch("logout","authentication",searchmatch("logfail","authentication")
| stats count BY type use this search as an approach for your searches. Ciao. Giuseppe
... View more