Hello,
Can you try this please, i simulate your report with creating raw filed, and then i extract country value, You can copy and past this request :
| makeresults
| eval raw="01/15/2020 07:45:00 +0000, search_name=BT_COUNTRY_TOTAL_SHP, search_now=1579075200.000, info_min_time=1579071600.000, info_max_time=1579075200.000, info_search_time=1579075209.762, AE=2, AU=5, BG=0, CH=0, CM=0, CN=3, CZ=4, FI=1, FR=1, GR=1, HK=2, HU=0, IE=0, IN=0, IQ=0, IT=2, JP=2, KR=1, KW=1, KZ=0, LT=0, MX=12, NG=1, NO=0, NZ=2, PL=0, PT=1, RO=3, RU=1, SA=0, SE=0, SG=1, SI=2, TR=13, US=17, VN=0, ZA=1, report=\"BT_COUNTRY_TOTAL_SHP"
| rex field=raw max_match=0 "(?<country>\w{2}\=\d+)"
| table country
| mvexpand country
| rex field=country max_match=0 "(?<country>\w{2})=(?<value>\d+)"
... View more