I think you are making this far more complicated than you need to. If I understand you correctly, a simple stats (or chart or timechart ) might do the trick. And avoid join - really. index=asindex source=Prod sourcetype=performance vo!=null lastLap>10000 earliest=-3d@d latest=-1d@d | timechart span=1d count avg(lastLap) by vo another option might be to use chart instead of timechart ; ... | chart count avg(lastLap) over vo by date_mday Hope this helps, K ... View more

Tks, worked fine !!!! ... View more