Hi everybody, I have some event data that looks like the tutorial data which you can find here : https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/GetthetutorialdataintoSplunk My data represents logs of some software that tracks the progress of customer incident cases. In this data, you have multiple fields like time (format dd/mm/YYYY hh:mm:ss), current state (like 'open'/'in progress'/'closed'), id of the case. Basically, what I want to do is to make a timechart of the number of cases that have been closed per month and to display the information of the maturity of the cases in the system like "cases that are in the system since more than 30 days" / "cases that are in the system since 15 and 30 days" etc. As I'm pretty new to Splunk, I can't figure out how to write the right query, so could you help me please ? At the moment I've got something like that : index=myindex sourcetype=* current_state="closed" | timechart count by id_case But that's pretty far from what I want to do... Thanks in advance, Regards, ... View more