Sorry this is me Intelli2019. I also have the Splunk Answers account nathc100 ... View more

Wow! It works just by replacing the double quotes with singles in the eval, who knew 🙂 Your 2nd and third answers removing the joins work too. Which leads me to believe you must know what you're talking about! Last minor things before awarding well deserved points. How do I get rid of rows/days where "ESLA File End" is null? Also would you recommend the first query you gave or the second append stats one to replace the joins? So many thanks! ... View more

Hi woodcock, Sorry mate I'm pretty new at this. Could you explain what your query does a little please? It looks like you're creating some raw data to query but this would be coming from a daily log file in my case. Cheers Nathan ... View more