Just add max_match=0 to both the rex command. Like this, and that should take care of that. index="xxxx" sourcetype="web_stats" *car OR *truck | rex max_match=0 "car=(?<car>\d+)" | rex max_match=0 "truck=(?<truck>\d+)" | timechart span=1d sum(car) as car sum(truck) as truck ... View more