Thanks a lot for the response @gcusello , it works. ... View more

Hi @gcusello  I used the same search which you shared above and didn't made any changes. I will share the screenshot shortly as I am getting some errors in uploading the picture. ... View more

Hello @gcusello  Thanks for the response. Unfortunately, I see only empty values for sourcetype column.  other 3 fields showing the info.  ... View more

Hello @gcusello  Thanks a lot for the swift response. the query gives the most of info I was looking for. However, it contains multiple entries for single index. Lets say If Index A has 3 sourcetypes, it appears in 3 rows.  Can we group them in a single row?  e.g: _time index sourcetype Vol_GB percentage 17th Sep Main  st1 st2 st3 100G 10.00% ... View more