Try something like this | streamstats count by ReasonCode EquipmentName reset_on_change=t global=f | where count=1 ... View more

Hi Ismo, your solution works. Thanks! 🙂   ... View more

That would seem to suggest that the rex extract didn't work for these LPNs. Try this to see what you get source="C:\\Logs\\*" host="myHost" index="dumpchutes" "TELEGRAMID=[42]" "LastDestination=[51]" 00008851780400696790 | rex "OriginalDestination=\[(?<OriginalDestination>[^\]]+)" | rex "OriginalDestinationState=\[(?<OriginalDestinationState>[^\]]+)" | rex "EntrancePoint=\[(?<EntrancePoint>[^\]]+)" | rex "EntranceState=\[(?<EntranceState>[^\]]+)" | rex "ExitPoint=\[(?<Chute>[^\]]+)" | rex "ExitState=\[(?<ExitState>[^\]]+)" | rex "BarcodeScannerId=\[(?<BarcodeScanner>[^\]]+)" | rex "BarcodeScannerDataState=\[(?<BarcodeScannerDataState>[^\]]+)" | rex "BarcodeScannerData=\[(?<LPN>[^\]]+)" | rex "Length=\[(?<Length>[^\]]+)" | rex "Width=\[(?<Width>[^\]]+)" | rex "Height=\[(?<Height>[^\]]+)" ... View more

Try something like this | makeresults | eval _raw="2021-06-18 21:05:45.037 +02:00 [Information] Status=[1111111111111111111111111111111111111111111111111111111111111111]" | rex "Status=(?<Status>.*)" | eval Status=split(trim(Status,"[]"),"") | streamstats count as row | mvexpand Status | streamstats count as item by row | eval item="item_".item | eval Status=case(Status==0,"Not OK",Status==1,"OK",Status=2,"Not Known") ... View more