Hello,   I've seen many others in this forum trying to achieve something similar to what I'm trying to do but I didn't find an answer that completely satisfied me. This is the Use Case: I want to compare the number of requests received by our Web Proxy with the same period in the last week. Then I want to filter out any increase lower than X percent.   This is how I've tried to implement it using the timewrap and it's pretty close to what I want to achieve. Only problem is that the timewrap command only seems to work fine if I only group by _time.     | tstats `summariesonly` count as event_count from datamodel="Web" where sourcetype="f5:bigip:ltm:http:irule" by _time span=10m | timewrap 1w | where _time >= relative_time(now(), "-60m") | where (event_count_latest_week - event_count_1week_before) > 0 | where (((event_count_latest_week - event_count_1week_before)/event_count_latest_week)*100) >= 40     This gives me a result like this. _time event_count_1week_before_week event_count_latest_week XXXX YYYY ZZZZ     If I try to do something similar but grouping by the name of the web site that it's being accesed in the tstats command then timewrap command doesn't work for me anymore. It outputs just the latest values of 1 of the web sites.       | tstats `summariesonly` count as event_count from datamodel="Web" where sourcetype="f5:bigip:ltm:http:irule" by _time Web.site span=10m | timewrap 1w | where _time >= relative_time(now(), "-60m") | where (event_count_latest_week - event_count_1week_before) > 0 | where (((event_count_latest_week - event_count_1week_before)/event_count_latest_week)*100) >= 40       That doesn't work. Do you know why that happens and how can I achieve what I want?     Many thanks.   Kind regards.   ... View more