Hello @bowesmana Example All number's are Numeric only message text fields from 1st event: Sequence numbers 00000000000000872510,00000000000000872511,00000000000000872512,00000000000000872513,00000000000000872514 message text fields from 2nd event: Sequence numbers 00000000000000872515,00000000000000872516,00000000000000872518,00000000000000872519,00000000000000872520 From the logs 00000000000000872517 was missing so need to check missing of sequence that is condition actually.. just need to check number is to be correct format ( one by one) or if its not correct need to throw alerts please suggest using regex expression for this issue, Below query i can able take first value from mentioned logs(events) | rex field= cip: Audit Message . Message Text"\D+(?<Sequence Number>\d+)" | table Sequence Number Output : 00000000000000872510 00000000000000872515 but i need whole sequence number in statistic table one by one, Hope u understood Thanks in advance
... View more