Hi @rpecka, you can use one of the answers of @bowesmana that are all correct or try adding: time_minutes<6 to your main search. Ciao. Giuseppe ... View more

It is not clear what you expect the result to look like - for example, if field1 contains either "A", "B", or "C", and field2 contains either "A", "B", or "C", do you want the frequency of "A" in field1 counted separately from the frequency of "A" in field2, etc.? ... View more

| chart count by id stageid | where foo!=0 ... View more

You're right. What I’m trying to do is not as complicated as I thought it was. I only need to duplicate the case statement once to get what I need. Thank you! ... View more