Hello @richgalloway found out | tstats ... by source provides less results than | tstats ... values(source)  in a search combining a query joined with tstats 🙃 | tstats min(_time) as firstTime max(_time) as lastTime values(source) as source WHERE index=* by host,index provides ALL sources | tstats min(_time) as firstTime max(_time) as lastTime WHERE index=* by host,index,source provides only 1 source ... View more

Hi @qs_chuy .. good catch. let me check this and revert back.  my mindvoice to me... some more "detailed understanding" required between -  the tstats, datamodels, accelerated, non-accelerated, thx ... View more