You can split it into 2 commands to make it work: ... | eval output=mvappend(field_1, field_2) | stats values(output) as output ... View more

Agreed. It would seem that you should be able to use a combination of the bin start/end options and the continuous flag, but (as I understand it) there are some finnicky things about the order of the bin options and how much option information splunk thinks is enough... and more than that is not allowed. ... View more