@mperrenoud - there are other ways to do it, that might be easier to read at your level. None of these are particularly more efficient than each other, so take your pick. The rule here is, use whatever method you will understand when you come back to modify it later. | rename COMMENT as "count up how many of each, assign count to 3-digit message name" | stats count by seq rectype | eval B2B=if(rectype="B2B",count,0) | eval DES=if(rectype="DES",count,0) | rename COMMENT as "stats B2B and DES values onto a seq record, then get rid of any records that dont have both." | stats sum(B2B) as B2B sum(DES) as DES by seq | where B2B > 0 and DES > 0 | rename COMMENT as "count up how many of each, assign count to 3-digit message name" | stats count by seq rectype | eval {rectype} = count | rename COMMENT as "get rid of rectype field, stats B2B and DES values onto a seq record, and then get rid of any records that dont have both." | fields - rectype | stats values(*) as * by seq | where B2B > 0 and DES > 0 ... View more