Try like this ("Received Request-ID-->") OR (Response_for_Request="Response sent for request Id") | rex "\>(?<areqstat1>\S+) " | rex "request Id - (?<areqstat2>\S+) " | eval areqstat=coalesce(areqstat1,areqstat2) | eval Application=case(areqstat LIKE "BTMS%","BTMS",areqstat LIKE "EVSN%","EVSN_Application",areqstat LIKE "DFLW%","DFLW_Application",areqstat LIKE "IDAP%", "IDAP Application",areqstat LIKE "ISF%","ISF Application",areqstat LIKE "ROLB%", "ROLB", 1=1, "Other") | eval type=if(searchmatch("Received Request-ID-->"),"received_count","sent_count") | chart count over Application by type ... View more