If you can limit yourself to words rather than phrases then this bit of code should work: index="myIndex" | makemv myField | mvexpand myField | stats count by myField It assumes that words are space separated, if you have any other separtor just tweak makemv command. What happens here is makemv splits normal text field into multi value field, mvexpand "flattens" it (puts each value as a separate event) and stats part just makes stats magic 🙂 ... View more