Here's the search, it seems pretty straightforward as far as I can tell. And I'm not sure why the chart would work in non-stacked mode with the exact same data. sourcetype="statcsv" | rename "Add Ops" as Add, "Bind Ops" as Bind, "Compare Ops" as Compare, "Delete Ops" as Delete, "Modify Ops" as Modify, "Search Ops" as Search | table _time, Add, Bind, Compare, Delete, Modify, Search ... View more