If you've events like below, the 2nd event can be merged with both first and second, so where should it go Or you want all three events to be merged together? _time | count(_time) | col 2017-02-28T05:42:45.000-05:00 | 1 | A 2017-02-28T05:42:44.000-05:00 | 1 | A 2017-02-28T05:42:43.000-05:00 | 1 | A ... View more

Try like this your base search | stats values(col1) as col1 values(col2) as col2 values(col3) as col3 by timesec delim="," ... View more