I'm glad it works. I should improve my point by saying that a "better" approach would probably be to have the Description be something actually useful. For example, in your Lookup table, you could have: ABC,"ABC - Transaction successful" DEF,"DEF - Database Deadlock, Contact Support Immediately!" And then the rest would work just fine. You might change the last query to ...| search Description=* | stats count by FieldA to maintain statistics about FieldA, from from a methodology perspective, if we're adding data we should add useful data. Anyway -- Food for Thought. ... View more