I'm hoping to get help. I have the below errors that are in the same event at in different lines. i would like to get the 1st column as Error, 2nd as count and 3rd as App. <Dsc>General Error:CODE0001-3032-CODE000-Error Msg 1</Dsc> <RpBy AppCd="EFG"/> <Dsc>General Error:CODE0001-3032-CODE050-Error Msg 2</Dsc> <RpBy AppCd="XYZ"/> <Dsc>General Error: Error, ANYTHING</Dsc> <RpBy AppCd="ABCD"/> Error msg is always after "General Error:" I was able to get it but I want to add the App name in the 2nd line in the same event. rex field=_raw max_match=100 ""General Error:(?<error>[\`\~\:\-\{\}\[\]\;\'\""\*\&\%\$\#\@\!\(\)\^\\=\-\?\/\.\,\\/\w+\d+\s+]+)<\/Dsc>"" The app name in the second line within the double quote. The results should be: Error APP count 1. CODE0001-3032-CODE000-Error Msg 1 EFG 1 2. CODE0001-3032-CODE050-Error Msg 2 XYZ 1 3. Error, ANYTHING ABCD 1 ... View more