Yes, I'll make some assumptions about your log format. | rex "text=Checking.+x=(?<x1>\w+) proj_id=(?<proj_id>\w+)" | rex "text=.*warning:.+x=(?<x2>\w+)" | table x1 x2 proj_id _time   ... View more

first query worked. Thank you ... View more

@danielcj and @Azeemering ,   adding "where isnotnull(json)" at the end of the query fixed the issue.   Thanks. ... View more