Your dedup is removing all the duplicated sources if I understand this correctly. Why not use the host field for these sources? That will be unique... So do something similar as.. index=ABC sourcetype=host Logon | rex field=source "/opt\/(?P<Client>w+))\/" |stats count by host, Client Your host field will be unique to each event. You can extract the Client name from the path and then do a dedup or stats count on it.. That will give you a unique count of events by host and by Client (username/ path on disk..) ... View more