thanks guys! fyi, looks like with 'limit' i dont need to sort anymore. source="swerve_sales.csv" host="swerve" sourcetype="csv-sales" | timechart span=1w limit=10 useother=f sum(TOTAL) as sales by FIRSTNAME ... View more

Are you using the default Splunk "greyscale" map tiles? If so, hit Format -> Tiles -> Presets -> Open Street Map to get map tiles that will zoom in all the way. Additionally, increase the maxzoomlevel=9 in your search. ... View more

Try this: source="vx-fcr.csv" host="vx-contacts" sourcetype="csv-vx-fcr" date_year = 2015 earliest=-60d | eventstats sum(count_fcr_eligible_cases) as total | timechart span=1w first(total) AS total sum(a) AS sumA BY b | eval sumA=sumA/total And this: source="vx-fcr.csv" host="vx-contacts" sourcetype="csv-vx-fcr" date_year = 2015 earliest=-60d | eventstats sum(count_fcr_eligible_cases) as total | timechart span=1w first(total) AS total sum(a) AS sumA | eval sumA=sumA/total Don't forget to click "Accept" to close out the Question if it works. ... View more