I narrowed it down. The seconds print out correctly, but when "eval totalDuration=strftime(totalSecs, "%H:%M:%S")" is added the totals do not come out correctly for the top 5. user totalSecs totalDuration user 1 148603874617.000000 23:59:59 user 2 84304119903.000000 23:59:59 user 3 67157542422.000000 23:59:59 user 4 51439802027.000000 23:59:59 user 5 35722091866.000000 23:59:59 user 6 32864320734.000000 23:59:59 user 7 21433250455.000000 00:40:55 user 8 12859955225.000000 01:47:05 user 9 12859951693.000000 00:48:13 user 10 10002183716.000000 00:21:56 user11 2857767945.000000 00:25:45 ... View more

Hi use appendcols command (host="zakta01.inno-360.com" AND mwv-landscaping.inno-360.com AND "GET \/search" AND query=*) OR (host="web01.inno-360.com" AND source="/var/log/apache2/mwv_ssl_access.log" AND "/profile-services/talent")| stats count as C1 by query|appendcols[search (host="zakta01.inno-360.com" AND mwv-landscaping.inno-360.com AND "GET \/search" AND query=*) OR (host="web01.inno-360.com" AND source="/var/log/apache2/mwv_ssl_access.log" AND "/profile-services/talent")| stats count as C2 by q] ... View more