I can take a shot at what you are looking for but I don't think I have enough information. Are the log files of interest sharing a common index or source type (I would assume so). Based on your description I understand that you want the total users on all instances within a give time bucket. you could do something like the below which assumes you have the number in the logs extracted as user_volume index=yourIndex sourcetype=yourSourcetype |timechart span=1h sum(user_volume) as total_users ... View more