Hi Please check if this helps.. I have added below line to your file to make sure we proceess both output you are looking for.. 19:30:06 C:\Pelibib\MBX\20190618193001754_MA07.MBX processed and deleted Add index and sourcetype before mentioned query.. | search _raw=*MA07* | rex field=_raw "\WMBX\W(?\d+)_MA07.MBX\s(?.*)and deleted" | rex field=_raw "\.TXT_(?\d+)\s(?.*)and deleted" | stats values(status) as status by file_name | eval status=mvjoin(status,",") | search status!=*sended | eval Result=if(like(status, "%processed ,sended%"), "File_received", "File_stuck_somewhere") output would look like file_name status Result 20190618193001754 processed File_stuck_somewhere 20190618193001755 processed ,sended File_received ... View more

Thank you very much! It worked. ... View more