All, both Rich and Gokadroid provided the solution Rich's search extracted the fields correctly and Gokadroid search calculated the value of the field correctly. I had to combine both answers to get what I wanted. I could not get the multi value fields to be extracted and calculated in one search, so I split each search by the pattern. I also used Rich's search to find all the multivalue fields , it did not correctly give me the values, but at least I identified them so I could do separate searches for them for ghostAccountPrompts I searched between = to &: mysearch | rex "\?(?[^=])=(?[^&]+)&." | eval length=len(valueOfField) |eval numArgs = mvcount(split(valueOfField,",")) | table Field, valueofField, length, numArgs for hyperlinkPrompts I searchd between = to HTTP: mysearch | rex "\?(?[^=])=(?[^=]+)\HTTP." | eval length=len(valueOfField) |eval numArgs = mvcount(split(valueOfField,",")) | table Field, length, numArgs thanks for all your help. Secondly if someone now can see the missing piece of the puzzle to expand the multi-value fields in one search then it will be useful learning exercise for me and am keen to try it. ... View more

Thanks for the prompt reply, this would of hit the nail on the head if it wasn't for something I missed. So for a single field in the get request this will work, but there is actually two fields... so need to now split the fields and achieve the same thing. So basically one get request string can contain one or more fields : GET /~/rest/collection?ghostAccountPrompts=IL46&hyperlinkPrompts=IL59,IL53,IC21 HTTP/1.1\r\nHost ghostAccountPrompts is one field - get the length of the value between Prompts= and & hyperlinkPrompts is another field - get the length of the value between Prompts= and HTTP Need to extract the fields and calculate length of values of the fields Need to search string GET /~/rest/collection? Extract the fields calculate the length of the field values put it in a table with each instance for field and length if possible a count for each Field Name and number of times same length is matched Field Length Count ABC 20 number of time ABC is length 20 ABC 10 number of time ABC is length 10 DEF 10 ... View more