Hello Splunk peoples! Would someone please help me figure out how to use timechart to find IIS time_taken by locations using a CIDR inputlookup to figure out the subnet's locations? To show you what I do have working on my Splunk 6.5.2 instance: the following search shows time_taken by c_ip from the IIS sourcetype: index=foo sourcetype=iis | timechart max(time_taken) by c_ip the following search builds a “host Location SubNet” table: index=foo sourcetype=iis [| inputlookup MyServers] | append [| inputlookup SubNetLocations] | table host Location SubNet …here is contents of my transforms.conf [SubNetLocations] filename = SubNetLocations.csv min_matches = 1 default_match = NONE match_type = CIDR(c_ip) [MyServers] filename = MyServers.csv …here is the contents of my MyServers.csv lookup: host ServerA …here is the contents of my SubNetLocations.csv lookup: SubNet,Location 184.174.182.128/26,Remote_IP 172.31.33.0/25,LAN_IP Yet, the following search: index=foo sourcetype=iis [| inputlookup MyServers] | join SubNet* max=0 [| inputlookup SubNetLocations] | timechart max(time_taken) as IISLatency by Location ...merges the Location values to 1 line, like: If I mouse over the different Locations on the right, the line color in the graph changes to that Location's color. By now I have tried following at least 10 other Splunk community pages (some on inputlookup and others on lookup)...but I can’t get anything to graph the Location values separately into their own time_taken value lines. Does anyone have any ideas how I can graph the Location values as their own line in the timechart graph? Thank you in advance. ... View more