declare @range int = 60 drop table #timeout select 'timeout: ' + substring(data, charindex('_EVENTTARGET:',data)+13, charindex('__EVENTARGUMENT:',data) - charindex('_EVENTTARGET:',data)-15) as timeout_object into #timeout from traxs_errors where context like '%Execution Timeout Expired%' and date_time > getdate()-@range and charindex('_EVENTTARGET:',data) <> 0 select timeout_object, count(*) from #timeout group by timeout_object union select context,count(*) from traxs_errors where date_time > getdate()-@range and context not like '%Execution Timeout Expired%' group by context having count(*) > 2 order by 2 desc