Hello team, I'm a splunk beginner and i'm looking for a solution. My research is: sourcetype="itsm_extract" Environement="Production" metier="Ass" groupe_proprietaire="MOE ASS FCT*" categorisation_produit_3="*ECH*" | eval _time=strptime(date_creation,"%d/%m/%Y") | eval RPTMois=strftime(_time, "%m") | eval Mois=strftime(_time, "%B") | stats count as "Total Incidents" by Mois,RPTMois | sort RPTMois | fields - RPTMois | append [search sourcetype="itsm_extract" Environement="Production" metier="Ass" groupe_proprietaire="PIL CC05 OPEN CIB IS RB N1" analyse_technique="Autre erreur batch" | fields + resume + date_creation | rex field=resume "(?:[A-Z0-9\-]*\_){4}[A-Z0-9]{2}(?<code_app>[A-Z0-9]{3})" | rex field=code_app "(?<car2>[A-Z0-9]{2})(?<car3>[A-Z0-9])" | eval code_app_final=if(isint(car3),car2,code_app) | join code_app_final [search sourcetype="ref_application" | fields + Code_Application,Affectation,Domaine | rename Code_Application as code_app_final] | eval _time=strptime(date_creation,"%d/%m/%Y") | eval RPTMois=strftime(_time, "%m") | eval Mois=strftime(_time, "%B") | search Domaine="*ECH*" | stats count(Domaine) as "Total Dysfonctionnements" by RPTMois,Mois | fields - RPTMois] image? Link: http://www.hostingpics.net/viewer.php?id=797097splunkanw.png My question is: how should i do to merge my events by month in order to have only one occurence of each month? This way to be able to do a stacked histogram. I have tried append, appendcols, multisearch.... Thank you for your help and sorry for this english. Kévin ... View more