Here is a simple, single eval that does it. Extend or reduce as required. | makeresults count=32
| streamstats count as decimal
| eval decimal=decimal-1
| fields - _time
| eval binary=
floor(decimal/256%2).
floor(decimal/128%2).
floor(decimal/64%2).
floor(decimal/32%2).
floor(decimal/16%2).
floor(decimal/8%2).
floor(decimal/4%2).
floor(decimal/2%2).
floor(decimal/1%2)
... View more