I think the easiest way (I'm not sure that it's the most effective one though) to obtain stats from various point in time is to add an incremental stats value using streamstats and then just filter out three points in time. Something like: <<your_search>> | streamstats dc(Incident_Number) as "incident Count" by APP_DETAILS Then you can do | timechart span=30d latest("incident Count") by APP_DETAILS Ths should be the easiest one because you don't need to use three different searches to calculate three distinct sets of values and then append them together (it's append, not join which you would want anyway).   ... View more

Data models are great for several things. The main thing is normalization of data. You can bring in different types of logs with different fields and search them using a set normalized field. For example. 3 different firewall might call the source ip differently. It might be called src_ip, client_ip, source_address. Using a data model you can search this using one standard name src. ... View more