I want to calculate sum of multiple fields which occur in different lines in logs I have logs like bmwcar=10 bmwtruck=5 nissantruck=5 renaultcar=4 mercedescar=10 suzukicar=10 tatatruck=5 bmwcar=2 nissantruck=15 i want to have timechart with sum of all cars and sum of all truck, so my output should be car=36, truck=30. i can do it like index="xxxx" sourcetype="web_stats" | timechart span=1d eval (sum(bmwcar)+sum(renaultcar)....etc) but this list is not fixed as a new car can be logged any time in future. so, i am using regex (.*car) and (.*truck) but i am not able to sum up all cars together and trucks together. index="xxxx" sourcetype="web_stats" *car OR *truck | rex "(?<vehicle>(.*car=[\d]+) | (.*truck=[\d]+) )" | table vehicle, _time | mvexpand vehicle | rex field=vehicle ".*=(?<cnt>(\d+))" | search cnt!=0 | timechart span=1d sum(cnt) by the above query, either i can get sum of all cars and trucks together or cars and trucks in a separate chart using separate quereies. but i wanted to have cars and trucks in a same chart in a single query. could you suggest any way to do it? ... View more