Hi hoyacom, take a look at this answer http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html and learn how it can be done using stats and/or chart Hope this helps ... cheers, MuS ... View more