Hello My firm currently has the dashboard below that shows top employees utilization and top sites visited. I am looking for a way to query how may times a person has or remote office has hit a certain site and how much utilization it is using. index="istr_security" sourcetype=bcoat_proxysg 10.X.X. | rex field=_raw "^\S+ \S+ \S+ (?\S+)" | rex field=_raw "(?[a-z]+://(?[^:/]+)\S+) (?\d+)" | rex field=fqdn "(?[^.]+\.[^.]+)$" | rex field=_raw "(?\d+) (?\d+) (?\d+)" | eval server_mbytes=round(server_bytes/1000000,2) | eval duration_secs=round(duration_msecs/1000,2) | timechart useother=0 sum(server_mbytes) by corpid Thank you ... View more