Below Regex can be used in field extractor in write your own regular expression syntax: ^(?< protocol>[\S]+)\s*?(?< field1>[\S]+)\s*?(?< field2>[\S]+)\s*?(?< hostOrIp1>[^:]+):(?< hostOrIp1Port>[\S]+)\s*?(?< hostOrIp2>[^:]+):(?< hostOrIp2Port>[\S]+)\s.*?(?< state>[\S]+) During search time this regex can also be used with rex to extract fields if fields are not already extracted: yourBaseSearch |rex field=_raw "^(?< protocol>[\S]+)\s*?(?< field1>[\S]+)\s*?(?< field2>[\S]+)\s*?(?< hostOrIp1>[^:]+):(?< hostOrIp1Port>[\S]+)\s*?(?< hostOrIp2>[^:]+):(?< hostOrIp2Port>[\S]+)\s.*?(?< state>[\S]+)" | table hostOrIp1, hostOrIp2 NOTE: Please remove the space in each of the tags, example "< protocol>", "< field1>" etc. ... View more

try this if your user name field is say "userName": index=bluecoat category="Translation" OR category="Pornography" | stats dc(category) as distinctCategory by userName| where distinctCategory>=2 ... View more

Your answer should work but alternatively you can try as below: O_name%\d{3}[A-Za-z](?P< my_field >[^\%]+) where the string starts with O_name% then waits for 3 digits with \d{3} then an alphabet A to Z or small case a to z with [A-Za-z] then the field extraction (?P< my_field >[^\%]+) to stop reading at a % then a + to match non % as many times till you hit a % NOTE: Added space between < and my_field and > as the formatting on the website wasn't allowing without space <.my_field> ... View more