I'm not sure if you have gotten this answered yet, but could you try using |stats sum(count) as sum_count by "sip_entities.originating" sip_entities.terminating and see if that works for you. The chart function will create a column for every field in the by command, regardless of if there is a value, so it'll put something in the chart visualization. stats , on the other hand, will just calculate for the fields that have values. ... View more

Brilliant thanks. It needs a little tweaking ( more cosmetic than anything else) but it's sent me down the right path. I can normally brute force my way when learning new systems, but it's nice to have help when you need it and coming from a non-db / programming backgrounding, this forum is a great help thanks to the contribrutors. ... View more

@StuReeves... Happens to all of us... all the time! Glad it worked 🙂 ... View more

I'd thought I'd drop an example search I've done for this that formats some of the output, as it can get a little mangled. I'm still getting my head around how Splunk works, but I hope it helps someone. <basesearch> | replace *T* with "* *" in call_time |replace PT*H*M*S with "* Hours * Minutes * Seconds" in duration|replace PT*M*S with "* Minutes * Seconds" in duration | replace PT*.* with "*.* Seconds" ... View more