Ok I found the field name and I tried to do this: | stats count by my_field_name But since the log message has unique timestamp and sometimes unique thread name, I am getting a table with rows for every single log message and with count =1.  Is it possible to edit log message to remove that timestamp part and leave only the common part: Instead of looking for count of this: 2023-01-01 01:02:40 INFO - Thread-1 com.example.ClassName : this is log A can we do count for this: this is log A   ... View more

Yeah I am interested in the first query: | stats count by your_field But it looks like in my case this entire log message line is 1 field but I cannot see its name though. I can see some other fields like 'host_name' and I am able to find a count of occurrences of different values for that field. Also, I tried to de-select all fields and I still can see log message: 2023-01-01 01:02:40 INFO - Thread-1 com.example.ClassName : this is log A   So I am not sure what field I can use. ... View more