You can run a search pipeline for multiple fields using the foreach command: http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/foreach ... View more

Thanks for the input everyone, I ended up going a more brute force method that seems to be working. I tagged all of the servers to be searched, then filtered them by SourceName so I only had a working pool of logs that were related to the software application I'm looking at. It's a bit more verbose than I wanted but I'm hoping as I get more data I'll be able to refine it. tag=Backup SourceName="Backup Exec" | eval Outcome=case(EventCode==57755 OR EventCode==34112, "Success", EventCode==34113 OR EventCode==34114, "Failure", NOT EventCode==57755 OR EventCode==34112 OR EventCode==34113 OR EventCode==34114, "Missed Jobs") | stats count by host, Outcome | rename host as "Server Name" ... View more

_time be propagated to each new event, meaning that each new event will retain the _time information from its parent event. I'm unsure why you wouldn't be able to group by date_hour or use a timechart per_day()... Are you using a fields command earlier in your search? Can you post your complete search? ... View more

That is similar to how I would approach it ...| stats dc(STATUS) by USERID ... View more