I have items visit log index with fields: category, item each event is a visit In addition, I have an index with all items in the system in form category, items_count I want to create a timechart of categories: <category> -> <visited items>/<all items> other time What I did: index="visited" | eval cat_item = category."/".item | timechart dc(cat_item) by category | foreach * [ search index="cat" category="<<FIELD? >>" | eval <<FIELD>>= '<<FIELD>>'/items_count ] But this does not work timechart here creates a table with categories as columns and, each row contains the count of visited items  Now the problem is how I get column name, and value in the subquery. In the examples, the <<FIELD>> is used for the column name and column value alike.  Please help           ... View more