Hi @osh55 , ok, please try this: index=sample1 ((sourcetype=x host=host1) OR sourcetype=y) | eval caller_party=if(sourcetype=x, substr(caller, 2), caller_party) | stats count(eval(sourcetype=x)) AS all_calls count(eval(sourcetype=y)) AS messagebank_calls BY caller | search all_calls=* See my approach and adapt it to your use case. Ciao. Giuseppe ... View more

The savedsearch command has a method for passing variables to the search.  That should make it possible to pass different values for earliest and latest.  See the Search Reference manual for details. ... View more