Thanks for the reply, I have kinda done that for the ping stats and worked a graph up using: index=cacti sourcetype="cacti:mirage" rrdn=ping | sort max(rrdv) | timechart max(rrdv) by hostname limit=0 That nicely gives me a gave of the maximum ping time during a given period for all hosts. However, there are two types of information for a device that I was looking at, Ping (singular value) and Network stats which has two (traffic_in / traffic_out). Whilst I can see events for both when I do the search by hostname, I can't seem to see how to get the values for the traffic_in/traffic_out that the Mirage addon should have imported. ... View more