Hi all, We have installed splunk 6.0.1. when we try to use stats count by source type we have a results of all 8 sourcetype we have. If we combine sourcetype and date_hour we have a results of only two sourcetype It's correct or some goes wrong? This are search I'm using earliest=-2h@h latest=@h | stats count by sourcetype WinEventLog:Application 5269 WinEventLog:Security 2138 WinEventLog:System 345 WinEventLog:application 12408 WinEventLog:security 9347 WinEventLog:system 286 linux_messages 16066 vmw-esx 32392 earliest=-2h@h latest=@h | stats count by sourcetype,date_hour linux_messages 14 6535 linux_messages 15 9536 vmw-esx 12 24669 vmw-esx 13 7723 Thanks ... View more