https://community.splunk.com/t5/Splunk-Search/a-little-search-assistance/m-p/543224#M153886 <P>sorry I forgot to mention I tried that and it only returns the number of events for the most recent day. If I remove the majority of the evals and customization adding that timechart works just fine.&nbsp;</P> Wed, 10 Mar 2021 16:29:31 GMT tkerr1357 2021-03-10T16:29:31Z https://community.splunk.com/t5/Splunk-Search/a-little-search-assistance/m-p/543105#M153845 <P>Hello all,</P><P>&nbsp;</P><P>I need some assistance using the search below to produce a timechart of the number of events per day for the last 90 days.&nbsp;</P><P>index=wineventlog source="WinEventLog:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" EventCode=25<BR />| search Source_Network_Address="*" ComputerName="*" User="*"<BR />| eval "Source IP" = coalesce(Source_Network_Address,"")<BR />| eval clientip=Source_Network_Address | sort- _time<BR />| iplocation "Source IP" | where isnotnull(lat)<BR />| streamstats current=f global=f window=1 first(lat) as next_lat first(lon) as next_lon first(_time) as next_time first(clientip) as next_ip first(Country) as next_country first(Region) as next_region by User<BR />| strcat lat "," lon pointA<BR />| haversine originField=pointA units=mi inputFieldLat=next_lat inputFieldLon=next_lon outputField=distance_miles<BR />|strcat next_lat "," next_lon pointB |eval time_dif=(((next_time - _time)/60)/60), distance_miles=round(distance_miles, 2), time_dif=round(time_dif, 2)</P> Tue, 09 Mar 2021 20:28:57 GMT https://community.splunk.com/t5/Splunk-Search/a-little-search-assistance/m-p/543105#M153845 tkerr1357 2021-03-09T20:28:57Z https://community.splunk.com/t5/Splunk-Search/a-little-search-assistance/m-p/543152#M153862 <LI-CODE lang="markup">| timechart span=1d count</LI-CODE> Wed, 10 Mar 2021 07:14:24 GMT https://community.splunk.com/t5/Splunk-Search/a-little-search-assistance/m-p/543152#M153862 ITWhisperer 2021-03-10T07:14:24Z https://community.splunk.com/t5/Splunk-Search/a-little-search-assistance/m-p/543224#M153886 <P>sorry I forgot to mention I tried that and it only returns the number of events for the most recent day. If I remove the majority of the evals and customization adding that timechart works just fine.&nbsp;</P> Wed, 10 Mar 2021 16:29:31 GMT https://community.splunk.com/t5/Splunk-Search/a-little-search-assistance/m-p/543224#M153886 tkerr1357 2021-03-10T16:29:31Z https://community.splunk.com/t5/Splunk-Search/a-little-search-assistance/m-p/543575#M153971 <P>I was able to resolve this but had to completely alter my search</P> Fri, 12 Mar 2021 17:51:27 GMT https://community.splunk.com/t5/Splunk-Search/a-little-search-assistance/m-p/543575#M153971 tkerr1357 2021-03-12T17:51:27Z