Here is the search, putting results in a summary index. sourcetype="SmtpPrevent_operational" dtime=*s | convert auto(dtime) | search dtime>=60 | sitimechart span=1h count(dtime>=60), count(dtime>=120), count(dtime>=180) (longhand version) sourcetype="SmtpPrevent_operational" dtime=*s | convert auto(dtime) | search dtime>=60 | sitimechart span=1h count(dtime>=60), count(dtime>=120), count(dtime>=180) | summaryindex spool=t uselb=t addtime=t index="dtime_plus_60" file="Summary Index DTime 60+,120+,180+ per Hour_1480261911.stash_new" name="Summary Index DTime 60+,120+,180+ per Hour" marker="" Now here is what ends up being in the summary index: 10/18/2012 10:00:00, search_name="Summary Index DTime 60+,120+,180+ per Hour", search_now=1350576300.000, info_min_time=1350568800.000, info_max_time=1350572400.000, info_search_time=1350576324.840, psrsvd_gc=27, psrsvd_v=1 ... View more

Is it possible to attach two searches to a single report? SEARCH ONE (daily report by host, time ranged -1d@d to @d) sourcetype="xxx" xtime=*s | convert auto(xtime) | search xtime>=6 | chart count(eval(xtime>=6)) as 6+, count(eval(xtime>=12)) as 12+, count(eval(xtime>=18)) as 18+ by host SEARCH TWO (daily report not by host but last 7 days worth of counts, time range -7d@h to now) sourcetype="SmtpPrevent_operational" dtime=*s | convert auto(dtime) | search dtime>=60 | timechart span=1d count(eval(dtime>=60)) as 60+, count(eval(dtime>=120)) as 120+, count(eval(dtime>=180)) as 180+ ... View more