I am not an expert but I got indexes, sources and sourtypes as well as a custom "Customer" field with the following query: source=* sourcetype=* [| eventcount summarize=false index=* | table index | format "(" "" "" "" "OR" ")"] | fillnull value="N/A" Customer | stats count by index, source, sourcetype, Customer | sort index, source, sourcetype, Customer ... View more