Your rex statement is wrong and even when fixed, it extracts duration as the string  duration 300 i.e. the full text, so you should use this rex | rex field=_raw "(?<time>.*),(?<alert_num>.*),(?<error>.*),\s?duration\s+(?<duration>\d+)" | eventstats max(duration) as maxDuration by alert_num | where duration=maxDuration so your duration field is extracted as a number rather than a string. Then simply add the by alert_num onto your eventstats. Note that you should still make your regex more robust. Using a greedy .* wildcard selection can easily cause your regex to break. For example as you know your field delimiter is a comma, use | rex field=_raw "(?<time>[^,]*),(?<alert_num>[^,]),(?<error>[^,]),\s?duration\s+(?<duration>\d+)"   ... View more

stats is used as dedup to remove duplicate records and format is used to convert results into a single linear search string. More on format here: https://docs.splunk.com/Documentation/SplunkCloud/latest/Search/Changetheformatofsubsearchresults#Change_the_format_of_subsearch_results ... View more