The solution to getting the appropriate time spans is to use the bin command along with stats by _time,  | eval _time=strptime(Week, "%m/%d/%Y") | bin _time span=1mon | stats values(Employee) as EmployeeID dc(Employee) as EmployeeCount by _time The span=1mon will case the date, as specified by the original Week value to be aggregated based on the month. The alternate is the string based approach | eval Month = mvindex(split(Week, "/"), 0) | stats values(Employee) as EmployeeID dc(Employee) as EmployeeCount by Month Note that this would not handle > 1 year, as the month would duplicate.     ... View more

Worked perfect, thanks. ... View more

Hi @JoeHubner, you should see the addinfo command (https://docs.splunk.com/Documentation/SplunkCloud/8.2.2202/SearchReference/Addinfo). It gives you the informations you need. Ciao. Giuseppe ... View more