1. Yes, excatly, i need the sum of the values in the errors column. 2. About timechart.. Actually i have a timechart with one product with query: index = nsw_prod_eximee ERROR | regex _raw="[F][G][S]\d{9}" | dedup formInstanceNumber | timechart count by dc(formInstanceNumber OR applicationNumber) where count in top99 But now i want to have all products which have different regex (FGS, FGH, FGT, USP) and different field to dedup (with FGS and FGH i need to dedup variable formInstanceNumber, for USP and FGT it's applicationNumber).  For one product it's okey, but how to connect all that regexes with dedups in timechart. That's my question.   ... View more