Hi your answer is really good but I chose @woodcock answer because of its simplicity and the lists are finally messing with the graphs... Thanks a lot for the answer and you allowed me to discover more about xyseries! ... View more

Hi @Sukisen1981 I simplified my input to stop bothering myself too much: { [-] license: licenseName serverURL: port@server.com total: 325 used: 29 } Or as a raw text is now: {"serverURL":"port@server.com", "license":"qacpp-mbrw v4.4", "total":"325", "used":"29"} I used your answer and modified it to get the expected result: index=cc_esm3_monitoring | stats max(total) as total, max(used) as used by license | eval tab="\""+"license:"+license+"\""+":"+"\""+used+","+total+"\"" | fields tab Which gives me the following results: "license:licenseName1":"0,11" "license:licenseName2":"3,11" "license:licenseName3":"0,3" "license:licenseName4":"1,11" Thanks for your help! Since I shifted from the original question, what should I do? ... View more