@manjunathmeti : I used the below query, but the counts are not matching. index="index1" ApplicationName IN (app1,app2,app3,app4,app5,app6,app7,app8,app9) | chart count(ApplicationName) over ApplicationName by Status | addtotals | append [| makeresults | eval ApplicationName=split("app1,app2,app3,app4,app5,app6,app7,app8,app9", ",") | mvexpand ApplicationName | fields - _time ] | fillnull value=0 | stats max(*) as * by ApplicationName I changed the query as below, here some applications are like appname and some like appname.application. So I added app1*,app2*,.... Now the counts are perfect and getting the duplicate application names. index="index1" ApplicationName IN (app1*,app2*,app3*,app4*,app5*,app6*,app7*,app8*,app9*) | chart count(ApplicationName) over ApplicationName by Status | addtotals | append [| makeresults | eval ApplicationName=split("app1,app2,app3,app4,app5,app6,app7,app8,app9", ",") | mvexpand ApplicationName | fields - _time ] | fillnull value=0 | stats max(*) as * by ApplicationName Can you please help me on this.
... View more