Hi .. thanks for the reply. i dont know where i am missing. its not working for me. for instance... | foreach *.stackTrace [| eval <<FIELD>> = "hello"] | stats latest(field1.field2.x.x.stackTrace) as stacktrace by fieldN.msg hello is not getting printed ......... but when i give  | foreach field1.field2.x.x.stackTrace [| eval <<FIELD>> = "hello"] | stats latest(field1.field2.x.x.stackTrace) as stacktrace by fieldN.msg hello is getting displayed  ... View more

really thanks a lot for ur timely help . ... View more