sourcetype=app_* some_search | rex "\[(?<transactionid>[A-Za-z0-9]+)\]" | stats values(*) as * by transactionid ... or, alternately... sourcetype=app_* some_search | rex "\[(?<transactionid>[A-Za-z0-9]+)\]" | transaction transactionid Removed the extra slash before the final quote. Added alternate to use transaction . ... View more

That's solid. It worked! Thanks a lot. ... View more

Thanks DalJeanis. It worked. Thanks for your kind help. ... View more

Although this solves the integer issue the time is now off. Still searching for solution that returns the correct time. ... View more