A bunch of things wrong with that search. You are not looking for a time series, so no point in timechart. Your timechart is just calculating count, so when you try to use mem_free after the timechart, that field is no longer present. You are using 'bin' command, which is about splicing by time, but you're not actually using _time in your stats - if you want to bin by _time with stats, then you do stats ... by _time after the bin. This should get you to what you want index="perfmonmemory" | eval mem_free=mem_free/1024 | eval mem_free=round(mem_free,0) | stats avg(mem_free) as rpm | gauge rpm 10 20 30 40 50 60   ... View more