Hi Dalador, You can try using the keepempty in the dedup: | rex field=_raw "Command\>(?<Command>[^\<]*)"
| rex field=_raw "Arguments\>(?< Arguments >[^\<]*)"
| table Task_Name, ComputerName,Command,_time,Arguments
| dedup Task_Name, ComputerName,Command,_time,Arguments keepempty=true Or you can try to use the fill null command: | rex field=_raw "Command\>(?<Command>[^\<]*)"
| rex field=_raw "Arguments\>(?< Arguments >[^\<]*)"
| table Task_Name, ComputerName,Command,_time,Arguments
| fillnull value="none"
| dedup Task_Name, ComputerName,Command,_time,Arguments
... View more