Does this help you get closer? | makeresults count=5 | streamstats count | eval uri = CASE ( count==1,"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",count==2,"bbbbbbbbbb",count==3,"ccccccccccccccccccccccccccccccccccc",count==4,"dddddd",count==5,"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" ) | fields uri | regex uri="[a-z-A-Z0-9+/]{4}|[a-z-A-Z0-9+/]{3}=|[a-z-A-Z0-9+/]{2}==" | eval uri_len = len(uri) | where uri_len > 24 | stats count by uri I'm using some self contained SPL to generate the data so this will need to be tweaked for your example ... View more

Here's a strawman to give you some ideas to explore (search to return only beacon events) | delta _time as TbB p=1 | stats avg(TbB) as AvgTbB max(TbB) as MaxTbB min(TbB) as MinTbB ... View more

thanks jeffland, richgalloway, and chimell for your assistance ... View more

thank you very much for the input, i will have a go at these options. it will at least give me more that what i have now haha. much appreciated ... View more