https://community.splunk.com/t5/Splunk-Search/I-m-having-trouble-with-the-quot-over-quot-syntax-How-to-use-it/m-p/355955#M105319 <P>Ah. You lost the values for <CODE>MachineState</CODE> in your <CODE>stats</CODE> command. Any field not present in the <CODE>stats</CODE> command is <STRONG>GONE</STRONG> after it.</P> <P>I'm assuming you have many more employees then you have machine states, so you may want to remember "over rowname by columnname")</P> <PRE><CODE> index="Plt15_tms3" ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber&lt;26 MachineState="*" | stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedSeconds by EmployeeLoggedInLastName MachineState | eval "Login Hours"=round(ElapsedSeconds/3600,2) | chart sum("Login Hours") over EmployeeLoggedInLastName by MachineState </CODE></PRE> Mon, 25 Sep 2017 14:16:49 GMT DalJeanis 2017-09-25T14:16:49Z https://community.splunk.com/t5/Splunk-Search/I-m-having-trouble-with-the-quot-over-quot-syntax-How-to-use-it/m-p/355951#M105315 <PRE><CODE>index="Plt15_tms3" ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber&lt;26 MachineState="*" | stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName | eval "Login Hours"=ElapsedMachineSecondsInOrderPath/3600 | chart sum("Login Hours") **over** MachineState by EmployeeLoggedInLastName </CODE></PRE> <P>updated - marked as code</P> Sat, 23 Sep 2017 02:25:36 GMT https://community.splunk.com/t5/Splunk-Search/I-m-having-trouble-with-the-quot-over-quot-syntax-How-to-use-it/m-p/355951#M105315 Hppjet 2017-09-23T02:25:36Z https://community.splunk.com/t5/Splunk-Search/I-m-having-trouble-with-the-quot-over-quot-syntax-How-to-use-it/m-p/355952#M105316 <P>hmm what is your desired output? can you be a bit more specific?</P> Sat, 23 Sep 2017 09:28:52 GMT https://community.splunk.com/t5/Splunk-Search/I-m-having-trouble-with-the-quot-over-quot-syntax-How-to-use-it/m-p/355952#M105316 Sukisen1981 2017-09-23T09:28:52Z https://community.splunk.com/t5/Splunk-Search/I-m-having-trouble-with-the-quot-over-quot-syntax-How-to-use-it/m-p/355953#M105317 <P>I was hoping to create a column chart that has totals for "Login Hours" that is separated by machine state(running, stopped) that is broken out by Employee last name.</P> Mon, 25 Sep 2017 12:40:13 GMT https://community.splunk.com/t5/Splunk-Search/I-m-having-trouble-with-the-quot-over-quot-syntax-How-to-use-it/m-p/355953#M105317 Hppjet 2017-09-25T12:40:13Z https://community.splunk.com/t5/Splunk-Search/I-m-having-trouble-with-the-quot-over-quot-syntax-How-to-use-it/m-p/355954#M105318 <P>@hppjet - can you post a quick mockup of your desired output?</P> Mon, 25 Sep 2017 14:07:00 GMT https://community.splunk.com/t5/Splunk-Search/I-m-having-trouble-with-the-quot-over-quot-syntax-How-to-use-it/m-p/355954#M105318 DalJeanis 2017-09-25T14:07:00Z https://community.splunk.com/t5/Splunk-Search/I-m-having-trouble-with-the-quot-over-quot-syntax-How-to-use-it/m-p/355955#M105319 <P>Ah. You lost the values for <CODE>MachineState</CODE> in your <CODE>stats</CODE> command. Any field not present in the <CODE>stats</CODE> command is <STRONG>GONE</STRONG> after it.</P> <P>I'm assuming you have many more employees then you have machine states, so you may want to remember "over rowname by columnname")</P> <PRE><CODE> index="Plt15_tms3" ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber&lt;26 MachineState="*" | stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedSeconds by EmployeeLoggedInLastName MachineState | eval "Login Hours"=round(ElapsedSeconds/3600,2) | chart sum("Login Hours") over EmployeeLoggedInLastName by MachineState </CODE></PRE> Mon, 25 Sep 2017 14:16:49 GMT https://community.splunk.com/t5/Splunk-Search/I-m-having-trouble-with-the-quot-over-quot-syntax-How-to-use-it/m-p/355955#M105319 DalJeanis 2017-09-25T14:16:49Z https://community.splunk.com/t5/Splunk-Search/I-m-having-trouble-with-the-quot-over-quot-syntax-How-to-use-it/m-p/355956#M105320 <P>Thank you for this solution and lesson. I didn't know it would be lost after stats.</P> Mon, 25 Sep 2017 14:26:38 GMT https://community.splunk.com/t5/Splunk-Search/I-m-having-trouble-with-the-quot-over-quot-syntax-How-to-use-it/m-p/355956#M105320 Hppjet 2017-09-25T14:26:38Z https://community.splunk.com/t5/Splunk-Search/I-m-having-trouble-with-the-quot-over-quot-syntax-How-to-use-it/m-p/355957#M105321 <P>@hppjet - yes, <CODE>stats</CODE> is a transforming command that summarizes all the records into a few new summary records. If you want to do something <CODE>stats</CODE>-like, but just want to add the calculated fields to every event, then use <CODE>eventstats</CODE>. If you want to do something that will process the events in order, like calculating an ongoing cumulative value across time, then use <CODE>streamstats</CODE> or <CODE>accum</CODE>. They each have their place.</P> Mon, 25 Sep 2017 15:00:20 GMT https://community.splunk.com/t5/Splunk-Search/I-m-having-trouble-with-the-quot-over-quot-syntax-How-to-use-it/m-p/355957#M105321 DalJeanis 2017-09-25T15:00:20Z