Would something like this give you results close to what you're after? index=main "blabla" | eval typeX=IF(userType="X",1,0) | eval typeY=IF(userType="Y",1,0) | timechart sum(typeX), sum(typeY) by state ... View more

Then you'll definitely need a lookup. Then you can do something like this: ... | chart count(user) by buildnum, eventType | lookup buildnum_to_clientversion buildnum OUTPUT clientVersion | fields - buildnum | table clientVersion, * The chart command should order things by buildnum . The lookup will go into the CSV file you've created that maps buildnum to clientVersion , pull out the clientVersion , and add it to the result. The fields command removes the buildnum field from the result, and finally, the table command reorders the fields so that the clientVersion comes first. Now your chart should show properly. Read about lookups in the Splunk documentation. There are a couple of ways you can do them, so you need to pick the most appropriate way to do it for your environment. ... View more