Okay, I have more information. The problem seems to be related to timewrap. For example, if I pull three days and put them in a timechart using the downsampled line chart visualization, I see everything displayed in UTC as expected. However, if I, say, throw a "| timewrap 1d"  in there, suddenly the visualization displays in local time while the statistics table continues to show UTC. I'm flat out of ideas, folks, so if anyone has any suggestions I'd be glad to hear them. ... View more

You know? You're right, I hadn't looked at it that way. Still don't like it.   Thanks. ... View more

The answer can depend on data characteristics.  On first look, I thought your solution was as efficient as it can get.  You reduced a large dataset (billions of events) to a much smaller dataset, i.e., distinct values of "Field B" grouped by distinct values of "Field A".  Can you give a comparison of scale of these two datasets? (I.e., how many rows after stats before where, compared to how many raw events.) A bigger problem is in problem statement.  There seems to be a misstatement in the description: table my search result needs to only return Value B; Values A and C will be thrown out, because they don't have a unique value in Field B. I believe you meant to say "because they don't correspond to a unique value in Field A," not Field B because every value in "Field B" is unique in your illustration.  Is every value in "FieldB" unique in real data?  Your SPL seems to imply so. Because otherwise mvcount(Field B)=1 can pick more than those corresponding to a unique "Field A".  For example, if dataset is Field A Field B Value A Value A1 Value A Value A1 Value B Value B1 Value C Value C1 Value C Value C2 Value C Value C3 your search will pick two data points Field A Field B Value A Value A1 Value B Value B1 But "Value A" is not unique in original data. (Neither is "Value A1".)  Can you clarify? ... View more

I was afraid of that. It's no big deal, I can hand-jam in the hex code for each system. Thanks for the response! ... View more

Yeah, I was afraid of that. I was hoping someone would have a magic work-around I hadn't thought of, as I do tend to find some winners around here. No worries, thanks for replying. ... View more