Great! Could you please mark the answer as accepted? Thanks! ... View more

Just updated again. Made a mistake. Basically, I forgot to remove eventstats from the subsearch and replace it with stats . I believe the suggested changes should run that query in about 2 minutes in the GUI, and about 40 seconds on CLI. (Basically, double the time of the version using stats without eventstats .) ... View more

I can make that change. Will MV be automatic, or will I also need to make a change to any configuration files? ... View more

Well, given your sample data, you can list them with a search like ... | rex field=_raw " (?<region_key>[^=]+)=us_west " | ... Plese note that the initial dots indicate your base search with source/sourcetype etc, and the trailing dots indicate the stats/chart/table/whatever operations you may want to use on your newly discovered regions. If your log messages contain double quotes (") around the values, you would probably need to escape them with a backslash in the rex statement... I guess. I haven't tried that one. Hope this helps, Kristian ... View more