Try something like this index="ss-stg-dkp" cluster_name="*" AND namespace=dcx AND (label_app="composite-*" ) sourcetype="kube:container:main" | rex \"status\":"(?<Http_code>\d+)" | rex \"evtType\":"\"(?<evt_type>\w+)"\" | rex field=_raw "Status code:"\s(?<code>\d+) | stats count(eval(Http_code>0 AND evt_type="REQUEST")) as "Totalhits" count(eval(Http_code <500 AND evt_type="REQUEST")) as "sR" count(eval(code =500)) as error ... View more

Use single quote to protect field names when there is some undesirable side effects from flattened JSON path. (search command cannot finesse this, unfortunately.) index="ss-prd-dkp" "*price?sailingId=IC20240810&currencyIso=USD&categoryId=pt_internet" | where status=500 AND 'context.duration' == 428.70000000006985 AND 'context.env.cookiesSize' == 7670 But note: Please use raw text format when sharing structured data. Those spath commands are not necessary. ... View more