Hi, You are not even using the mvfilter function, you are searching for it as a string. What is the goal, do you want to filter for events that have the host in the list of servers, or do you want to change the servers list somehow? If it is the former question, then you could use the mvfind command, eg: | makeresults | eval host="serverName02", servers="serverName01;serverName02;serverName03" | makemv delim=";" servers | where isnotnull(mvfind(servers,host)) Is that what you were looking for? Hth, Kai. ... View more

Thanks acharlieh. It's working after I changed it to *\[(?P[^]]+)". index="appIndex*" host="somehost" | rex field=_raw "^[^[\n]*\[(?P[^]]+)" | transaction TransUID ... View more

This will generate your bin names and min/max byte values for the bins. I've assumed a maximum of 1000K with the count=1000, but you can do whatever you like here. index=bluecoat cs_host=[cs_host search pattern goes here] | stats max(cs_bytes) as cs_max | eval CSK_max = floor(cs_max/1000) | map search="makeresults count=1000 | streamstats count as TheBin | eval CSK_max = $CSK_max$ | eval keepme = if(TheBin<=CSK_max,1,0) | search keepme=1" maxsearches=1 | append [makeresults | eval TheBin = 0] | eval minBytes=1000*TheBin | eval maxBytes=1000*TheBin+999 | eval NextBin = TheBin + 1 | eval TheBinName=TheBin."KB - ".NextBin."KB" | eval EventCount=0 | table TheBin TheBinName minBytes maxBytes EventCount giving results something like this - 0 0KB - 1KB 0 999 0 1 1KB - 2KB 1000 1999 0 2 2KB - 3KB 2000 2999 0 3 3KB - 4KB 3000 3999 0 then append your base results like this (without calculating anything but TheBin, because you'll get those values from the above "fake events") | append [search index=bluecoat cs_host=[cs_host search pattern goes here] | eval TheBin=floor(cs_bytes/1000) | eval EventCount = 1 ] and then sum them up like this | stats sum(EventCount) as EventCount, first(TheBinName) as TheBinName, first(minBytes) as minBytes, first(maxBytes) as maxBytes by TheBin | sort 0 minBytes edited to use sort 0 rather than sort in case there were more than 100 values to be sorted. ... View more