There probably are a few ways to do that.  Here's one. <<your search>> | rex "\s(?<a>\d+)\/(?<b>\d+)" | where a!=b ... View more

If the rex is not extracting the fields (which would be shown as columns in a table), then the rex expression (based on your sample data) does not match your real data. Please provide an accurate representation of your actual event data, preferably in a code block </> to reduce formatting corruption. ... View more

this is beautiful. thanks so much. it works perfectly. ... View more

thanks, that worked.  ... View more

actually it did work. i had been using 'by Category' on both fields. thanks for the help! ... View more

Hi @HelloItsMe76, if you need also to check duration, you have to modify the search, something like this: index="abc" "string1 OR string2" | eval string=if(searchmatch("string1"),"String1","String2") | stats dc(host) AS dc_host values(host) AS host dc(string) AS dc_string earliest(_time) AS earliest latest(_time) AS latest | eval duration=latest-earliest | where dc_host>1 AND dc_string>1 AND duration>2 | mvexpand host | table host Ciao. Giuseppe ... View more