Yes - chart did the trick! Thanks ... View more

Thanks for the reply - yes - that's going the right way. I appreciate that  answering questions, when you cant see the data is best effort. That does produce a table ('body.objectname' has become 'body.CounterName') as you can see. index=azure sourcetype="mscs:azure:eventhub:vmmetrics" body.Computer=* (body.CounterName="% Processor Time" OR body.CounterName="% Committed Bytes In Use" OR body.CounterName="Disk Transfers/sec") | eval CounterValue=round('body.CounterValue',0) | stats first(CounterValue) by body.Computer body.CounterName DO you know how I would get the body.CounterName fields to be the column headers? Computername CPU% MEM% DiskRate Comp1 3 45 34 Comp2 5 56 2 etc Do you join up multiple searches or perhaps transpose or can you do a Stats field by field by field? ... View more