Here's my search string: host=abc* source="/log...*" | rex "^[\d|-]+ [\d|:|,]+ (?P<Identifier>[\w\w|_]+)\s" | transaction Company startswith="HelloPhrase" endswith="GoodbyePhrase" | timechart useother=F avg(eval(duration/60)) by Identifier Within the start/end events, I want to parse and then extract the max of a number that appears within another event and additional information provided there. I've tried to illustrate what I'm looking for... StartEvent... Event1 [Number 1, processing size 100]... Event2...additional information Event45 [Number 7, processing size 50]... EndEvent I want to know how long it takes to complete the task and what the max number is along with the processing size of that event. Any suggestions would be greatly appreciated. ... View more