Try adding below to replace message with the one you are looking for. index=mint event_name=APIServiceError appEnvironment=Release appVersionName>=3.0 ( extraData.message="Incorrect email or password for*" OR extraData.message="Street address and/or city is too long*" OR extraData.message="The following address could not be found:*" OR extraData.message="We failed to authorize your payment card. Please verify your payment card is valid." OR extraData.message="The network connection was lost." ) | eval extraData.message=if(like(extraData.message, "Street address and/or city is too long*"), "Street address and/or city is too long",extraData.message) | stats count by extraData.message | sort -count  ... View more