You could try with max_match to capture multiple values once the transaction has been created. Yes! Thanks! max_match is the answer! Per the rex documentation page, under Optional Arguments: max_match Syntax: max_match=< int > Description: Controls the number of times the regex is matched. If greater than 1, the resulting fields will be multivalued fields. Defaults to 1, use 0 to mean unlimited. As you suggested, define the fields with multiple events AFTER the transaction AND use the max_match argument on those fields: search | use rex to define a common field, CCID | transaction CCID | use rex to define: subproccess field names and durations with max_match=0, total process duration and a few other identifying fields, URI, RespCode | table URI,Processor,SegDuration,TotalDuration,RespCode gives me exactly what I want, like in your 1st response. ... View more