You could try something like this:   index="inlooxtt" StatusName!=Paused StatusName!=Completed StatusName!=Cancelled PerformedByName!=Donado* OR (index="inlooxtasks" ProjectStatusName!=Paused ProjectStatusName!=Completed ProjectStatusName!=Cancelled ContactDisplayName!=Donado* ContactDisplayName!="null") | eval Tiempo=(DurationMinutes/60), Tiempo2=WorkAmount | stats dedup_splitvals=true sum(Tiempo) as Tiempo, sum(Tiempo2) as Tiempo2 by ProjectName | eval Tiempo=round(Tiempo,2) | sort ProjectName   An OR clause will be much more efficient than appendcols, and you can aggregate all the data before transforming it in stats. Hope this helps! -Greg ... View more