I would probably put this into a dashboard so you could run the following search: YourSearch | eval Match=if(var1=var2,"Match","No Match") And then do post processing for the number of matches and mismatches: | timechart count by Match and for the variations of Var1: | timechart distinct_count(var1) I was trying to find a way to put it all into one search, but couldn't see an easy way to allow it to chart over time. For a one time result, you could use the following: YourSearch | eval Match=if(var1=var2,"Match","No Match") | eventstats distinct_count(var1) as Var1Count | stats count, first(Var1Count) by Match It's a bit hokey, though. Perhaps someone will take it the rest of the way. ... View more

The timechart can't perform the eval math, my mistake. As a quick fix to get you going, do the search as you originally had it, but add "by _time" to the end of your stats command. That will produce the time values you need for the timechart. ... View more