Hi, I'm pretty new to splunk searches and i am trying to report on successful logins for login types 7, 8, 10 and 11, but always one of my columns are empty depending on the time i pick, and the column is always different, index=win* AND (EventCode=4624) AND (Logon_Type=7 OR Logon_Type=8 OR Logon_Type=10 OR Logon_Type=11) AND (host="DESKTOP*" OR host="LAPTOP*") | bucket _time span=1w | eval username = mvindex(Account_Name,1) | dedup username consecutive=true | eval dayTimeStr = strftime(_time,"%Y-%m-%d") | chart count over username by host I also pipe the data into a table command just to sort out the data for visual purposes. 0 0 0 0 0 0 N 0 5 0 0 0 0 0 0 0 0 N 0 4 0 0 7 51 0 0 0 0 N 0 0 0 0 0 0 13 0 0 0 N 0 0 0 0 0 0 0 14 0 0 N 0 0 0 0 0 0 0 0 22 0 N 0 0 0 0 0 0 0 0 0 19 N 0 0 0 0 0 0 0 0 0 0 N 4 39 0 0 0 0 0 0 0 0 N 0 0 5 0 0 0 0 0 0 0 N 0 0 0 34 The above is the count given to all users and the N column are null values showing as blank, and when i change the time span the null column switches to another column. ... View more