Here is a simple, single eval that does it. Extend or reduce as required. | makeresults count=32 | streamstats count as decimal | eval decimal=decimal-1 | fields - _time | eval binary= floor(decimal/256%2). floor(decimal/128%2). floor(decimal/64%2). floor(decimal/32%2). floor(decimal/16%2). floor(decimal/8%2). floor(decimal/4%2). floor(decimal/2%2). floor(decimal/1%2) ... View more