Try this index="new_tor" "Destination to Source negative jitter Number/Sum/Sum2" | rex "Number/Sum/Sum2:\s+(?<Number>\d+)\/(?<Sum>\d+)\/(?<Sum2>\d+)" | timechart span=1min values(Sum) as Jitter-Sum | sort - _time | head 10 What should happen is the rex command creates the field "Number" and assigns it the value of whatever numbers it finds (hence the \d+ ) before the next forward slash. It does the same thing with Sum and Sum2. Here's some good documentation on regex: http://www.rexegg.com/regex-quickstart.html Also a cool app you can use for practicing and testing your regex: http://www.regexr.com/ ... View more