Try this |script getallworkloads.wrapper|table href labels os_detail agent| rex field=os_detail \((?.+)\)| rex field=agent agent_version('.*?)'(?.*?)' |rex field=href "\/orgs\/1\/workloads\/(?.*)"|makemv delim="," labels|rex field=labels "(?\/orgs\/1\/labels\/\d+)'}" | mvexpand label| lookup getLabels href as label OUTPUT| eval app=case(key="app", value)|eval role=case(key="role", value)|eval loc=case(key="loc", value)|eval env=case(key="env", value)| stats valeus(workload_uuid) as workload_uuid valeus(os_detail) as os_detail, values(agent_version) as agent_version, by env loc app role |outputlookup illumioLabels.csv ... View more