Thank you @yuanliu for the idea. I think your idea could work. A colleague suggested the below query which worked and I went with it for now: | tstats count where index="*" [ inputlookup CSS_Customers where Region = $inputregion$ | fields Customer | rename Customer as index] by index, cfc, _time span=$span$ | timechart span=$span$ limit=0 sum(count) by index   ... View more