If you really want the formatting to be the way you mentioned in your question (using list), how about trying this below which will remove the duplicate problem first and then table it out like you want: index=ao_status sourcetype=checkConfig | rex "^.*\sConfig_Name=(?P[^\s]+)\sConfig_Status=(?P[^\s]+)" | stats count by cfgName, cfgStatus, host | stats list(cfgName) as "Config_Name", list(cfgStatus) as "Config_Status" by host However I would suggest using the below one to keep track of the cfgName and cfgStatus mapping to host intact in all cases for scenarios where the status has more than one value for a particular config (exa. /etc/httpd.cfg having say NOT-OK first and then OK later on): index=ao_status sourcetype=checkConfig | rex "^.*\sConfig_Name=(?P[^\s]+)\sConfig_Status=(?P[^\s]+)" | stats count by cfgName, cfgStatus, host | table cfgName , cfgStatus, host | rename cfgName as "Config_Name", cfgStatus as "Config_Status" ... View more