one from solution... your base search with maximum timerange you have e.g. last 1 month | fields _time UserId ApplicationId | eval TimePeriod=if(_time>=relative_time(now(),"-1d"),"Last_1_Day","") | eval TimePeriod=if(_time>=relative_time(now(),"-1w"),TimePeriod." Last_1_Week",TimePeriod) | eval TimePeriod=if(_time>=relative_time(now(),"-1mon"),TimePeriod." Last_1_Month",TimePeriod) | makemv TimePeriod | chart dc(UserId) over ApplicationId by TimePeriod ... View more

Hi Somesoni2 - thanks for the solution, I am getting same values for all day, week, month with search of 1month, not sure what is missing, tried few options no luck, please help. Thanks, BK ... View more