| makeresults | eval domain="" | append [| makeresults count=100000 | streamstats count as A | eval domain="domain".A | fields domain | format] Isn't it okay if you don't divide it? ... View more