Spot on! Thanks, the "sort" is the part I was missing to put the transactions next to each other. Just for transparency, those prefix lines are standard rfc5424 syslog fields, so a Splunk addon I have is already extracting them for me so I have _time, host, appname, procid already extracted. The final search to do the trick looks like this (minimizing the changes to demonstrate what was important here based on your input). appname=sftp-server | rex field=_raw "session (opened|closed) for local user (?<sftp_user>[^ ]+) from" | rex field=_raw "close \".*\" bytes read (?<sftp_bytes_read>\d+)" | sort 0 host appname procid _time | filldown sftp_user | timechart sum(sftp_bytes_read) by sftp_user   ... View more