In your original search, try changing: | search user="$m_user$" to: | where user="$m_user$" The where command interprets quoted strings as literals and should do a better job of comparing strings with an escape character. ... View more

If your number of unique users is fairly low, you may be able to use map to dynamically search over the current day for each record. Assuming the field names of _time, user, and login_status, I think something like the following should work in place of your subsearch: | eval earliest=relative_time(_time,"@d"), latest=relative_time(earliest,"+24h") | map search="search index=* user=$user$ earliest=$earliest$ latest=$latest$ | eval day=strftime(_time,\"%Y-%m-%d\")| fields day user login_status" maxsearches=50 Of course you'll probably need to put in an index name and the other arguments to narrow the map search down to the event type you're looking for, and make sure maxsearches is set high enough to iterate over each unique user, but you should then be able to use the day field to bin/timechart the data as needed. ... View more