Great i have solved it by your explanation dineshraj9! thank you ... View more

I have the solution! Because of the criteria in the front of the string (GPS OR NIAS) it could never find something else as OVERIG... With that one deleted and the 0=0 solution i finally got it: index=tibco TerweeAdapter | rex field=_raw "ConversationID=(?.*)" | eval n=substr(bericht,1,3) | eval code=case(n="GPS","GPS",n="NIA","NIAS",0=0,"OVERIG") | stats count by code code count GPS 76 NIAS 12 OVERIG 9 Thanks for the help! ... View more