thanks to you both. but the result is still in one row and not in one column. so, if I try to use your tip, I'll get the following outcome: _time | max(NumberResourceMailBoxes) | max(NumberSharedMailBoxes) | max(Number AnitvirusPositive) 2017-07 | 123 | 3456 | 8797 2017-08 | 111 | 222 | 3333 but I want to have it like this: _time | Description | Value 2017-07 | max(NumberResourcemailBoxes) | 123 2017-07 | max(NumberSharedMailBoxes) | 3456 2017-07 | max(NumberAntivirusPositive) | 8797 ...... ... View more

thanks so much! was really easy 😄 ... View more

Unfortunately reporting on implicit sourcetypes or indexes is not possible, unless there is new auditing added in 6.5. The answer given by inventsekar is as close as you will come. ... View more