Try the code below, I took a few liberties based on my test environment, such as bin'ing the data at 1m intervals and averaging those values (in case any are sampled more than 1m at a time. You'll also need to add your additional sort logic if you still need this. If you visualize this as a bar graph and enable Trellis it looks something like: index=os (sourcetype=cpu cpu=all) OR (sourcetype=vmstat) | table _time,pctIdle,swapUsedPct,memUsedPct | bin _time span=1m | stats avg(pctIdle) as cpu, avg(memUsedPct) as mem, avg(swapUsedPct) as swap by _time | eval values=mvappend(values,if(isnull(cpu),null,"cpu="+tostring(cpu)),if(isnull(swap),null,"swap="+tostring(swap)),if(isnull(mem),null,"mem="+tostring(mem))) | fields - cpu,mem,swap | mvexpand values | rex field=values "(?P<stat>.*)=(?P<value>.*)" | fields - values | stats avg(value) as avg,max(value) as max,min(value) as min by stat | eval caption=case(stat="cpu","CPU Usage",stat="mem","Memory Used",stat=swap,"Swap Used") | fields stat,caption,avg,max,min ... View more