Greetings all, Noob here. I have the following timechart: index=fileshare user_login=john_doe@mycompany.com (event_type=SHARE OR event_type=EDIT OR event_type=UPLOAD OR event_type=DOWNLOAD OR event_type=DELETE) | timechart span=1mon@mon count by event_type Time range is 4 months I would like to do the same for about 100 users (i.e. 100 "user_login" addresses). Basically, I would like something like this but with multiple rows: Do you have any ideas on how I can automate it? Maybe a trellis chart? I tried index=fileshare created_by_login IN (john_doe@mycompany.com, jane_smith@mycompany.com... etc etc ) (event_type=SHARE OR event_type=EDIT OR event_type=UPLOAD OR event_type=DOWNLOAD OR event_type=DELETE) | stats count by created_by_login, date_month, event_type But the separate colors for events are not shown in each month - any ideas? Thank you Mitsos ... View more