I did it a bit different: index=syslog app=myapp env=pr | search pushed |eval combo="PutMetric" + "_" + role + "_" + dc| timechart count by combo |appendcols [ search app=myapp env=pr Throttling | eval THROTTLE = "THROTTLING" + "_" + role + "_" + dc | timechart count by THROTTLE ] In this way I get the THROTTLE eval overlayed to the combo eval. I used it to find out how many boto requests were throttled by AWS. ... View more