Hi All, How do we all the values for a single field? Currently, the chart is displayed with the LoginName(x axis) with the count of LoginName(Y axis). Please see below ScreenShot,  What is needed- Display all the values(Endpoint channel, Destination, FileName,IncidentTime, Count) of the each and every LoginName.  Screenshot below, Currently, I am not getting these values and only getting count of LoginName. This is the query that is used, index="prod" sourcetype="*" |rex "sourceServiceName=(?<sourceServiceName>[\w\s]+)\s+\w+=" |rex "duser=(?<duser>[\w\s]+)\s+\w+=" |rex "fname=(?<fname>[\w\s]+)\s+\w+=" |rex "cat=(?<cat>[\w\s]+)\s+\w+=" |rename sourceServiceName as EndpointChannel duser as Destination loginName as LoginName fname as FileName _time as IncidentTime cat as PolicyName |fieldformat IncidentTime = strftime(IncidentTime, "%Y/%m/%d %H:%M:%S") |top showperc=f EndpointChannel Destination FileName PolicyName IncidentTime by LoginName | sort -IncidentTime This query works only in Statistics view and when I click the visualization, I'm not getting the other values. Can someone please help? TIA  ... View more