event is json: {message:AZK} x 10 {message:BCK} x 5 {message:C} x 3   What Im trying to get is a table to count message by values with a modified text Message AZK -  10 Message BCK -  5 C - 3   I use this: | eval extended_message= case( match(_raw,"AZK"),"Message AZK", match(_raw,"BCK"),"Message BCK", 1=1, message) | stats count as nombre by extended_message | sort nombre desc | table extended_message, nombre   I can't not get the "C" in the list to be counted the message from the JSON event is not interpreted (i don't know) Thanks for your help   ... View more