I am trying to compare users logged in by device vs users logged in via html site. For device, the query is something like: index="prodenv" host="Somehost" Mobile.aspx s_port="443" cs_username!="-" | stats count For html, the query is something like: index="prodenv" cs_method="POST" cs_uri_stem="/data/commands.svc/login" sc_status="200" | stats count I tried to combine these two with something like the following: index="prodenv" host="Somehost" | eval mobile=Mobile.aspx s_port="443" cs_username!="-" | eval html=cs_method="POST" cs_uri_stem="/data/commands.svc/login" sc_status="200" | stats (make a pie showing mobile vs html) ...which of course didn't work. How can I combine these two in order to achieve my desired result? ... View more