If it's a rolling 60 day period, you'll want to use a pretty complex class of reports where you use timechart OR stats , and then you use streamstats . To start you off with a simpler example, here's a report that searches the _internal index and shows total indexing volume for the sourcetype "splunkd", over a rolling 24 hour period. index=_internal group="per_sourcetype_thruput" series="splunkd" | timechart span="1h" sum(kb) as KB | streamstats sum(KB) as 24HourRollingKB window=24 Your case though, with the distinct counts, is a little more unusual. This search will give you, for each day, the rolling distinct count of userId's in the last 30 days up to that point. foo | bin _time span="1d" | stats values(userId) as userId by _time | streamstats dc(userId) window=30 (You might want to put a sort - _time before the streamstats. Sort of depends from what side you want to calculate things) and then from there you can get the 1 day with the highest rolling-30-day-period distinct userId count by just sorting those results and getting the top value: foo | bin _time span="1d" | stats values(userId) as userId by _time | streamstats dc(userId) as distinctUsers window=30 | sort - distinctUsers | head 1 ... View more