This wasn't exact, but it got me there. It was displaying as a value, but it was actually (apparently) a field. This query gave me no results, but I modified my original query and added fields - VALUE and that worked. Now just to tidy up and make a bit more efficient. Thanks for your help. I didn't know about the 'fields' command. Final result: index=nest error_code!="VALUE"| fillnull value=NULL error_code | timechart usenull=f useother=f cont=false span=30m count BY error_code | fields - VALUE ... View more