Hi based on your examples (I just take some of lines and changed those little). index=_internal | head 1 | eval _raw ="time,src,ASA_Version, GP, User, dst, CT Aug 31 2020 12:10:37, x.x.x.x, %ASA-6-722055:, Group <Default>, User <user1>, IP <x.x.x.x>, Client Type: Cisco AnyConnect VPN Agent for Windows 4.x.x Aug 31 2020 12:10:36, x.x.x.x, %ASA-6-722055:, Group <Default>, User <user2>, IP <x.x.x.x>, Client Type: Cisco AnyConnect VPN Agent for Windows 4.x.x Aug 30 2020 12:10:27, x.x.x.x, %ASA-6-722055:, Group <Default>, User <user4>, IP <x.x.x.x>, Client Type: Cisco AnyConnect VPN Agent for Windows 4.y.y Aug 31 2020 12:10:14, x.x.x.x, %ASA-6-722055:, Group <Default>, User <user6>, IP <x.x.x.x>, Client Type: Cisco AnyConnect VPN Agent for Windows 4.y.y" | multikv forceheader=1 | rex field=CT "Windows (?<CT_Version>\d+\.\w+\.\w+)" | eval _time = strptime(time, "%b %d %Y %T") | rename COMMENT as "Above prepare sample, below creates result" | timechart span=1d count by CT_Version r. Ismo  ... View more

hi @macd0170 try this if it helps. in default/inputs.conf add/replace one kv pair under each stanza as passAuth = user_with_admin_role ... View more