Hi @rock_s , I don't really understand the latest requirement. Can you please just give an example output table as you need it, with some sample data. I guess it is easier to understand with that. Thx ... View more

Hi @xsstest , you could use an approach like this (this is an example because I haven't your search): index=wineventlog | eval day=if(date_mday=strftime(now(),"%d"),"today","yesterday") | stats count(eval(day="yesterday")) AS yesterday count(eval(day="today")) AS today BY EventCode Then make all the filters you like (greater than, less than, perc of, etc...). Ciao. Giuseppe ... View more