Hi @larunrahul, You can use the rex, chart, and where commands to extract the call type, summarize the events, and filter the results, respectively: | makeresults format=csv data="_raw TXN_ID=abcd inbound call INGRESS TXN_ID=abcd inbound call EGRESS TXN_ID=efgh inbound call INGRESS" | extract | rex "inbound call (?<call_type>[^\\s]+)" | chart count over TXN_ID by call_type | where INGRESS!=EGRESS TXN_ID EGRESS INGRESS efgh 0 1 I've used the extract command to automatically extract the TXN_ID field in the example, but if your events are already indexed, Splunk will have done that for you automatically. ... View more