Hi @marshallsuk, You have to extract a part or your URLs wi the parent_sites. I tried using you table, but, for the next time, please, don't use a screenshot because it's completetly unuseful to test a regex, but put some sample data using the Insert/Edit Code Sample Button. Anyway, please test this regex: index=iis s_contentpath = "/sites/Teams*" | rex field=s_contentpath "\/sites\/Teams5\/(?<s_contentpath>[^\/]+)" | dedup s_contentpath | chart last(_time) as Time by s_contentpath | convert ctime(Time) | sort Time asc you can test the regex at https://regex101.com/r/gYJ1NM/1 Ciao. Giuseppe ... View more