@ellenbytech - Sorry, updated to put quotes around "PWPL" In answer to your question, NO, that's what the streamstats is tasked to do... copy the last open/closed status from the same location forward onto each record. Since a PWPL record has no status of its own, it gets the one from the immediate prior record of either an open or close type. ... View more

Absolutely! There are a couple of different tricks if you wanted to use this kind of code with multiple levels of breakdown, like _time and Location. I'll just give you one that you can slot into the above method. Your search that returns the relevant event records | bin _time span=1d | stats sum(Ones) as Ones, sum(Fives) as Fives , ... sum(Hundreds) as Hundreds by _time Location | eval combo = "_time="._time." Location=".Location | untable combo BillType BillCount | rex field=combo "_time=(?<_time>\d+)" | rex field=combo "Location=(?<Location>[^$]+)" | fields - combo You now have one record with the BillCount for each BillType at each Location and _time , that you can feed to whatever visualization you'd like. For instance, you could do this if you wanted to look at only the Hundreds across _time by Location | where BillType="Hundreds" | timechart span=1d sum(BillCount) by Location Or if you wanted to see the Hundreds and Twenties, you could create a synthetic series name like this... | where BillType="Hundreds" OR BillType="Twenties" | eval Location = Location." - ".BillType | timechart span=1d sum(BillCount) by Location ... View more