| rename COMMENT as "for counting events by release, we only need the _time and a record type marker"
| eval rectype="detail"
| fields rectype
| rename COMMENT as "now we add the release records and sort them in front of any events on the same date"
| append [| inputlookup append=t ReleaseCalender.csv | table Release Production | rename Production as _time | eval rectype="deleteme"]
| sort 0 _time rectype
| rename COMMENT as "copy the Release onto all succeeding records until the next Release record, default nulls to zero."
| streamstats last(Release) as Release
| eval Release=coalesce(Release,"0")
| rename COMMENT as "kill the Release records then stats it up"
| search rectype="detail"
| stats count as Count by Release