1 Use status instead of sourcetype 2 Yes, it is. | eval create_date = strptime(CREATED_DT, "%Y-%m-%d %H:%M:%S.%Q") | eval _time=create_date 3 I have no idea without log. ... View more

hi @zovinchong Can you please try this? YOUR_SEARCH | table Ann Betty Charlie Dave | streamstats window=1 values(*) as class_* | foreach class_* [ eval class=mvappend(class,<<FIELD>>)] | eval class=mvdedup(class) | fields - class_* | mvexpand class | eval Ann=if(class=Ann,1,0),Betty=if(class=Betty,1,0),Charlie=if(class=Charlie,1,0),Dave=if(class=Dave,1,0) | stats sum(*) as * by class Sample Search: | makeresults | eval Ann="a",Betty="a",Charlie="b",Dave="a" | append [| makeresults | eval Ann="a",Betty="b",Charlie="b",Dave="b" ] | append [| makeresults | eval Ann="a",Betty="c",Charlie="b",Dave="b" ] | append [| makeresults | eval Ann="b",Betty="c",Charlie="c",Dave="b" ] | append [| makeresults | eval Ann="b",Betty="c",Charlie="c",Dave="c" ] | table Ann Betty Charlie Dave | streamstats window=1 values(*) as class_* | foreach class_* [ eval class=mvappend(class,<<FIELD>>)] | eval class=mvdedup(class) | fields - class_* | mvexpand class | eval Ann=if(class=Ann,1,0),Betty=if(class=Betty,1,0),Charlie=if(class=Charlie,1,0),Dave=if(class=Dave,1,0) | stats sum(*) as * by class Thanks ... View more