Thanks! Works perfectly 🙂 ... View more

Assuming you need to split the events not only with ARTIST, but also PLAY_DATE, You should do the latter first since you split the ARTIST field with mvexpand. you just need to take off the mvexpand part. it would be like STATION_ID="S1" OR STATION_ID="S2" | stats values(STATION_ID) as station by ARTIST, PLAY_DATE | eval station = if (mvcount(station)==2, "shared", station) | bin PLAY_DATE span=1d | stats dc(ARTIST) as play_count by station, PLAY_DATE to merge them would be difficult, since mvexpand breaks a field. I don't have any great ideas, so I would just call appendcols or something for now. (query1) | appendcols [ (query2) ] by the way, please verify this assumption. if one play had ARTIST A;B at station1, and another had ARTIST B;C at station2. the two are not shared plays, but B is a shared artist. right? ... View more

perfect answer 🙂 thanks a million guys .. i really appreciate it. ... View more

Wow that's amazing!!!! So much quicker and I get all the info I needed. Thanks very much, our OpsTeam will salute you! 🙂 ... View more

Try like this index="win*" tag=authentication src=* dest=* LogonType=* | stats values(src), values(dest), values(LogonType) by user ... View more