Hi, I have a lookup file like this - users: User1 User2 User3 User4 ... I need to count the events by user: index=myindex  | stats count as count by user | inputlookup append=true userlist.csv | fillnull count | stats sum(count) as count by user | table user count It shows me the number of events per user in the CSV file. If a user has no events, the count is 0: user count User1 2593 User2 301 User3 0 User4 1284   But I need the output additionally splitted over time (span=1h). The output should look like this: time user count 11.08.2020 11:00:00.000  User1 1023 11.08.2020 11:00:00.000 User2 190 11.08.2020 11:00:00.000 User3 0 11.08.2020 11:00:00.000 User4 1284 11.08.2020 12:00:00.000 User1 1570 11.08.2020 12:00:00.000 User2 111 11.08.2020 12:00:00.000 User3 0 11.08.2020 12:00:00.000 User4 0 time + 1h ... ...   I saw few other questions in splunk answers but they didnt work for me... I hope you could help me. Thank a lot! ... View more