Thank you very much for the reply, normally I play the senior T-SQL developer for MS SQL dev team. Manager wants to dual role me with splunk reports etc. So this is sort of kind of familiar etc. Under to gun of course to fix old stuff and make new stuff. while waiting on reply I trudge forward and found this | stats sum(Users) as UserLogins, sum(Documents) as DocumentUploads, sum(LoansSD) as CreatedSD, sum(LoansBD) as CreatedBD, sum(LoansLOD) as CreatedLOD by source | addtotals Created* fieldname="CreatedTotal" col=t labelfield=SERVICE label="Totals" | rename source as SERVICE this worked, I did try your snippet as well since you took the time to write it up, but i get "No results found." did i do something wrong? | stats sum(Users) as UserLogins, sum(Documents) as DocumentUploads, sum(LoansSD) as CreatedSD, sum(LoansBD) as CreatedBD, sum(LoansLOD) as CreatedLOD by source | eval CreatedTotal = CreatedSD + CreatedBD + CreatedLOD | rename source as SERVICE     ... View more