@jasonhask  Can you please try this? YOUR_SEARCH | bin span=1m _time | stats values(srv*) as srv* by _time | eval flag = 0 | foreach srv* [ eval flag = if(flag == 0 AND <<FIELD>><800 AND <<FIELD>> > -1, 1 , flag) ] | where flag=1 | fields - flag, srvTotal   I hope this will help you. Thanks KV If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated. ... View more