Yeah, join can be a pain to get working properly. You will probably want something like: <search1> | join type=outer max=0 overwrite=false clientip [ search <search2> ] ... View more

The problem here is that the charting subsystem requires that stacked elements be in different series in the table. Your search has to yield something like: User 1 2 ----- --- --- User1 2.5 User2 3.1 User3 2.8 1.5 User4 7.4 You can convert your table to one like this by renaming values(Hour) to vals and adding at the end: | mvexpand vals | eval counter=1 | streamstats sum(counter) as instance by clientip | chart first(vals) as val by USER instance Here we break each user into their individual values, use streamstats to accumulate an instance count, and reformulate the chart using the USER and instance. ... View more

Thanks. What worked for me was doing a |search linecount<2 from my results. That matches all of my "requests" and "answers" up into transactions that should always be 2 lines. ... View more