I find it easiest to use the rex command. ... | rex "user\\\"\\\":\\\"\\\"(?<user>[^\\\"]+)" ... View more

You can do this (note I have uppercased your field names for simplicity with the multikv command. | makeresults | eval _raw="DATETIME SRC_MACHINE_NAME COL1 COL3 1/1/2020 Machine1 Value1 Value2 1/2/2020 Machine1 Value1 Value5 1/31/2020 Machine3 Vavleu11 Value22 2/1/2020 Machine1 Value1 Value2 2/2/2020 Machine2 Value1 Value5 2/28/2020 Machine3 Vavleu11 Value22" | multikv | eval _time=strptime(DATETIME,"%m/%d/%Y") | timechart span=1mon count and that will give you a bar chart with 3 for Jan and 3 for Feb. Your code is from the | eval if you do not have _time or from the timechart if you have _time that represents datetime However, this is giving you the number of ROWS in each month and is not really any count of machine names. If you want to count rows that have Src_machine_name where some rows do not have the machine name, then change count to | timechart span=1mon count(SRC_MACHINE_NAME)  or if you wanted the UNIQUE machine names each month then this would work | timechart span=1mon dc(SRC_MACHINE_NAME) Hope this helps  ... View more