I've created a search that displays the top 10 blocked destination ports over the last 4 hours. I've also managed to create a search that not only does that but also shows the top 10 blocked destination ports for the same time period for the previous day. This works, albeit a bit slowly, for me: index=netfw sourcetype="firewall" action!="allowed" earliest=-4h@d latest=now | stats count by dest_port | sort -count | head 10| multikv| eval ReportKey="Last 4 Hours" | append [search index=netfw sourcetype="firewall" action!="allowed" earliest=-2d@d latest=-1d@d | stats count by dest_port | sort -count | head 10 | multikv| eval ReportKey="Yesterday - same timeframe" | eval _time=_time+86400] As I'd (sort of) expect this generates three columns: dest_port, count, ReportKey. If I select Bar Chart in the Visualization tab I actually get two bar charts, 'count' and 'ReportKey'. Only the 'count' one have any data in it. What I'm trying to achieve now is to get a bar chart to work which displays the top 10 for both time periods, if that makes sense? Basically you should be able to look at the chart and see today's data in say yellow and yesterdays in say blue. It might be that port 80 the top blocker today and yesterday but there's a different port (and count) in second. Is this something that is possible to achieve or am I over-reaching again? Also - not sure if this is the most efficient way to do this search so any input on making this quicker as well would be really appreciated. Thank in advance ... View more