Hi @TooManyQuestion This is a much simpler way given that you are using a line chart and don't need events for every day, just days when things change | makeresults
| eval events="Open 4/3/2020 TBD
Closed 4/3/2020 9/10/2020
Open 4/3/2020 TBD
Open 4/3/2020 TBD
Closed 5/6/2020 7/4/2020
Closed 5/6/2020 8/6/2020
Open 8/6/2020 TBD"
| rex max_match=0 field=events "(?<events>.+)\n*"
| mvexpand events
| rex field=events "(?<Status>\w+)\s+(?<Opened>\d+/\d+/\d+)\s+(?<Closed>.+)"
| fields Status Opened Closed
| fields - _time
| eval _time=strptime(Opened,"%m/%d/%Y")
| eval closedate=strptime(Closed,"%m/%d/%Y")
| fieldformat closedate=strftime(closedate,"%Y-%m-%d")
| eval Status=if(Status="Closed",mvappend(Status,"Open"),Status)
| mvexpand Status
| eval _time=if(Status="Closed",closedate,_time)
| stats count as tickets by _time Status
| eval tickets=if(Status="Open",tickets,-tickets)
| stats sum(tickets) as change by _time
| streamstats sum(change) as tickets
| fields - change
... View more