Hi @mnjmht18 Try any one of the following | makeresults | eval log="date1 name : message one,date2 name : message two,date3 name : message one,date4 name : message one,date5 name : message three,date6 name : message three" | makemv delim="," log | mvexpand log | rex field=log "name :\s+(?P<log>[^:]+)$" | stats count by log or | makeresults | eval log="date1 name : message one,date2 name : message two,date3 name : message one,date4 name : message one,date5 name : message three,date6 name : message three" | makemv delim="," log | mvexpand log | eval log= mvindex(split(log,"name :"),-1) | stats count by log ... View more