fixed it: | rex field=line.message "order_id\\\":\s\\\"(?<order_id>[^\\\"]+)" | table order_id ... View more

Hi,  Thanks for your reply.  The sample event contains a large amount of data and the company I work for would not be happy about me sharing this sensitive information. However, It might help if I elaborate. A unique user (User_ID=B123456) has multiple events containing the fields User_ID and Agent. For this user the User_ID field never changes.  The events of a second unique user (User_ID=B654321) are completely unrelated to the first user (User_ID=B123456). Although they contain the same fields User_ID and Agent.  Basically, the count of true and false for each row (User) should be independent of the other rows (Users).  Hope this helps!  Let me know if you have any other questions.  Cheers!    ... View more