As @richgalloway already pointed out, you can't aggregate data by a field that's not in your events. And a "Period" field most probably isnt't there. Furthermore - unless you want to do a comparison of two different periods, you'd simply just pick a time range with the timepicker to contain a single day/week/month/whatever or use earliest= and latest= constraints within the search itself. And you'd probably want to use tstats instead of stats - calculating stats over summaries is way way faster than searching from raw indexes. You can also use either the license report directly, as @richgalloway said or look and calculate your stats over the index=_internal source=*/license_usage.log There are a few options to get the stats - which one to use depends on what you need it for. ... View more