You would be getting a multivalued fields. Are you sure you're not able to extract second set? Do you see both values if your add | table contentUUID title at the end of your current search. ... View more

can you add this before your rex command?: |makemv delim="},{" data ... View more

You need source for a canonical list of "all the XYZ things". For simplicity, let's not use xyz but rather host . Let's assume you have the canonical list in a set of tags, then you can use this search to obtain it: | rest/servicesNS/-/-/configs/conf-tags | search YourTagNameHere=enabled | fields title | rex field=title mode=sed "s/host=//" | rename title AS host Let's assume it is in a CSV, then you can use this search to obtain it: | inputcsv MyCSV | table host In any case, once you have the search that generated the canonical list of hosts, you can do a search like this: YOUR DATA SEARCH HERE | append [YOUR SEARCH FOR CANONICAL LIST HERE] | stats values(*) AS * BY host You might start with a tstats search because it is so much more efficient: | tstats count where index=_* OR index=* BY host sourcetype index | append [YOUR SEARCH FOR CANONICAL LIST HERE] | stats values(*) AS * BY host Be aware that if you are doing stats count instead of stats count(something) you will have to do this at the end to get rid of the added non-data list: | eval count = count - 1 ... View more