You can use "|sort count=0 fieldname" to eliminate 10000 limit. ... View more

Thanks, this worked well. I did tweak it with somesoni2's changes and to not have 100 hardcoded: your search terms here | eventstats max(count) as rangeHigh | eval countAs=mvrange(1,rangeHigh) | eval countAs=mvindex(countAs,0,count-1) | mvexpand countAs | stats count by countAs ... View more

A different approach that I tried that seems to work is to use join to find fields from the start event: event=fps | join usetime=t earlier=t max=1 server [search (event="testcase.start")] | where testName="test02" | eval _time=max(finalFrameTime)/10000000 - 11644473600 | timechart median(median) ... View more