Hi @jeganl, Please try below query; sourcetype=access_combined domain=abc | eval raw_len=len(_raw) | stats sum(raw_len) as Domain_usage by domain, action_type, _time | eval raw_len2=Domain_usage/1024/1024 | stats list(_time) as _time list(action_type) as action_type, list(raw_len2) as action_type_usage_in_MB, sum(Domain_usage) as Domain_usage_in_GB by domain | eval Domain_usage_in_GB=Domain_usage_in_GB/1024/1024/1024 | sort -Domain_usage_in_GB   ... View more