I'm not sure I asked the right question, but I'd like to use substr to extract the first 3 letters of a field and use it as a grouping field. My query is as follows: * | stats sum(bytes_in) as MB by user_id as substr(user_id,1,3) | eval MB=round(MB/1024/1024,2) | sort -MB head 20 The syntax validates, however, no results are returned. Taking the substr out returns results, but of every user, not grouped by branch code. Any help would be greatly appreciated. ... View more