thank you very much! That was the missing piece, plus I had to move the eventstats prior to the transaction clause. I suppose given the same field=value, when in the context of the transaction it is seen as 1 occurrence of Consolidate in the event. final query: index=myindex | eventstats count(eval(match(Consolidate,"True"))) as ConsolidateTrue by RequestId| transaction RequestId | table RequestId ConsolidateTrue results in RequestId ConsolidateTrue 123 2 456 1 thank you for the assist cmerriman!!! ... View more

when i run my data model as | from datamodel:"DemoModel2.DemoDataSet2" in my search bar, i get 2000 rows in events tab, but only 232 rows in statistics tab. Anyone has idea regarding this issue? ... View more

thanks Rich, this worked!!!! I only wish I had posted this question earlier...it would have saved some trouble but I really wanted to understand this for myself 🙂 Previously I had tried... (?<field>.*)\n but the match did not pick up the end of line character. In studying your answer I think I've learned that I need to also quantify the end of line character in the matching pattern...else the matching will not "stop" with ".*" thanks again! ... View more

thank you sundareshr - this got me on the right track. I tried the separate report, but it was only taking the last-assign stanza. i.e. UE_method was extracted but not UE_msg. Continuing with this approach however, the following seems to work: props.conf REPORT-UEmsg = UE_msg REPORT-UEmethod = UE_method transforms.conf [UE_msg] REGEX = (?m)unhandled error.*(?System\D+\:.*)\.\s [UE_method] REGEX = (?m)unhandled error.*(?(SOURCE_B|SOURCE_C)\D+)\s this has gotten me very close to what I need. I still am wrestling with the regex of the UE_method as it is extracting the rest of the stack trace instead of the specific line I want, but I will other posts for a solution and post a new one if needed. thanks! ... View more