If you typed it in literarily as you wrote here - you didn't put the pipe sign at the beginning. It is important. If you copy-paste the search (of course substituting your index names) as I wrote it - with the pipe at the start, it's treated as the tstats command with appropriate arguments. If you omit the leading pipe, the "tstats" word and most of the rest of the line is treated as arguments to the implicit search command. So you need to do | tstats dc(host) by index where index=xxxx_server_xxxx OR index=xxxx_network_xxxx not tstats dc(host) by index where index=xxxx_server_xxxx OR index=xxxx_network_xxxx   ... View more