Hello, The problem is how will I assign new-status if I didn't got that event? We have 7 OPF which are fixed i.e. "2E, PE, PN, TE, TN, SA, AE". But if any of the OPF not generated in log file that information also we have put in column and status should be "NO" . I'm extracting OPF through Rex and it will extract only those which are present. It won't give the names of those OPF's which are not in the log file. I am using like this, index="test-trail" | rex "File\sgeneration\sfor\sMISAOR\sOPF\s(?P<OPF_NAME>[A-Z]{2})File\s(?P<FILE_NAME>A11.*A1.*).txt\scompleted" | rex "File\sgeneration\sfor\sMISAOR\sOPF\s(?P<OPF_NAME>2E)File\s(?P<FILE_NAME>A11.*A1.*).txt\scompleted" | rex "File\sgeneration\sfor\sMISAOR\sOPF\s(?P<OPF_NAME>AE)File\s(?P<FILE_NAME>JK.*).txt\scompleted" | eval Date = strftime(_time, "%Y-%m-%d %H:%M:%S") | stats count by FILE_NAME Date | eval name="2E, PE, PN, TE, TN, SA, AE" | eval OR_NAME=substr(FILE_NAME, 1, 2) | eval OPF_NAME=substr(FILE_NAME, 9, 2) | eval Status=case(count>0, "Yes", count=0, "No") | fields OR_NAME OPF_NAME FILE_NAME count Date Status name | rename count as "Files Received" ... View more