Hi I have a field, mode, which returns either returns data or is None (mode_true, mode_false). I'm trying to search and aggregate the sum [over time] of both outcomes over separately then plot both on a timechart (as a stacked bar or similar, where the data is separated categorically). I've tried a couple query types below with no luck 1.)   index=mode_qa module=mode_producer_logs "telemetry_event" | extract pairdelim="\"{,}" kvdelim=":" | multisearch [search mode!=None | eval type="mode_true"] [search mode=None | eval type="mode_false"] | timechart span=60m count(mode) by type   2.)   index=mode_qa module=mode_producer_logs "telemetry event" | extract pairdelim="\"{,}" kvdelim=":" | eval modeBool = if(mode!=None, "mode_true", "mode_false") | timechart count by modeBool span=30m     Both display a visual with only one data source (not binary, e.g. mode_true vs mode_false). Any ideas? New to Splunk ... View more