Yours should have ended like this: | rex field=fieldnamevalue "\"?(?<fieldname>[^:\"]+)\"?:\"?(?<fieldvalue>[^:\"]+)\"?" | eval {fieldname} = fieldvalue | fields - fieldnamevalue fieldname fieldvalue | stats values(*) AS * BY session | reverse | filldown | table id,cr,se,so,code,var,pNum,counter | reverse ... View more