Assuming the format of "path" including location of segments is static, you can extract each segment as separate field, like this   your current search which fetch field path | rex field=path "\/(?<env>[^\/]+)\/site\/(?<country>[^\/]+)\/(?<status>[^\/]+)"     And then run your aggregation per your requirement your current search which fetch field path | rex field=path "\/(?<env>[^\/]+)\/site\/(?<country>[^\/]+)\/(?<status>[^\/]+)" | stats count by env country status | where country="usa" AND env="dev" AND status="active" | sort 5 -count ... View more