| makeresults | eval _raw="<queues> <queue name=\"mdm.inbound\"> <stats size=\"100\" consumerCount=\"4\" enqueueCount=\"5\" dequeueCoun=\"6\"/> <feed> <atom> queueBrowse/mdm.inbound?view=rss&amp;feedType=atom_1.0 </atom> <rss> queueBrowse/mdm.inbound?view=rss&amp;feedType=rss_2.0 </rss> </feed> </queue> <queue name=\"notification-mst\"> <stats size=\"20\" consumerCount=\"30\" enqueueCount=\"40\" dequeueCoun=\"50\"/> <feed> <atom> queueBrowse/mdm.inbound?view=rss&amp;feedType=atom_1.0 </atom> <rss> queueBrowse/mdm.inbound?view=rss&amp;feedType=rss_2.0 </rss> </feed> </queue> </queues>" | spath path="queues.queue{@name}" output=queue_name | spath path="queues.queue.stats{@size}" output=size | spath path="queues.queue.stats{@consumerCount}" output=consumerCount | eval tmp=mvzip(queue_name,mvzip(size,consumerCount)) | fields - _* | stats count by tmp | eval queue_name=mvindex(split(tmp,","),0), size=mvindex(split(tmp,","),1) , consumerCount=mvindex(split(tmp,","),2) | table queue_name size consumerCount hi @johnsmits I extracted it. ... View more