Thank you, that explanation was really helpful. I tried adding what you suggested but even after playing around with some of the syntax, I am still getting "Error in 'eval' command: The arguments to the 'split' function are invalid." I can't seem to figure out why, maybe there's a small error in what I'm doing? I can use my actual service names if that helps at all, was just being cautious about using actual information but can't imagine it matters at all. My search that returns the above error is below. It just has the three services called. Any input would be much appreciated index=xx sourcetype="yy" Service="POST /loan/api/" OR Service="POST /credit/api/ OR Service="POST /transfer/api" | chart count over Service by ZCode | append [ | makeresults | eval Service=split("POST /loan/api/", "POST /deposit/api/", "POST /transfer/api") ] | stats values(*) as * by Service | fillnull value=0 | addtotals
... View more