Final version: COMMAND=/bin/su - process=sudo| rex "(?i) sudo: (?P[^ ]+)"| table date_month, date_mday, host, path_name |dedup host path_name| sort date_mday, host, path_name| search path_name>0| rename "date_month" as "Month" "date_mday" as "Day" "host" as "Server" "path_name" as "User ID" Works perfect! Thank you! ... View more

Ryan, Thank you for the answer, I really appreciate it. This is what I used: (time 24 hours) (IP Adress) www.*| bucket span=15m _time | stats list(catdesc) AS Description, list(count) as count by hostname | sort -Count I get: Hostname Description Count Google Search Engines and Portals was blank. Do you know how to covert the descriptions to counts and only show: Google Search Engines and Portals 37. Does the bucket span 15 take the length (24 hours) and break it down into 15 minute increments? Thank you ... View more