Hi, I have a problem with this query executed on 3 months index="app" host="sl0920*" source="/home/java/jboss-eap-6.2/app/log/teller-web.log" OR source="/home/java/jboss-eap-6.2/app/log/desktop-web.log" priority="FATAL" category="AUDIT*" message="{Invoking*" | eval date = strftime(_time, "%Y-%m-%d") | stats count as Contatore by message,correlationId,date | where Contatore > 1 | eval tot = Contatore/2 | chart sum(tot) as tot by date Is it possible rewrite the same query with a query with better performances please ? ... View more