I want to determine the top n days of a time period based on a criteria and then get some statistics only on those days. Do I use a subsearch? I can write the searches for these two things separately but I cannot link them. Also I don't know how to pass specific days as parameters to my search. I have something like this for determining the days: index=potato | bin _time span=1d | stats sum(piece) AS sum_piece BY _time | sort -sum_piece | head 3 How can I pass this? Or is there a simpler solution? Thanks ... View more