did you try instead of stats to use:   | timechart count by ccc exception span=1d  ... View more

Did anyone managed to resolve that issue, we are facing the same problem seem very basic function that is not working as expected, the linked mention guide is useless as it does not solve the issue  tried to use an existing source type like csv mscs:storage:blob:csv trying to create a custom and somehow force header read with all the available options all are seem to be ignored , very frustrating loading simple 5 line + header file onto blob storage and although we see the file in splunk as comma delimited it never auto extract the fileds    ... View more