I want to convert the result from https://community.splunk.com/t5/Splunk-Search/Find-users-who-have-done-an-event-A-but-not-done-an-event-B/m-p/110560 into monthly timechart. I have tried the following query, but does not work:     index="x" (event="A" OR event="B") | stats count(eval(event="A")) as ACount count(eval(event="B")) as Bcount by userId | where ACount >= 1 AND BCount < 1 | timechart span=1mon count as result     Can anyone help me with this query? ... View more