Thank you! Fixed a spelling error (ZSum instead the XSum you clearly meant) and tried it. Ended up using this query to count my max CPS (calls per second). I added "1" for TCount to the final result and it matches the events I see when I narrow to the second:
host=myhost* "Received INVITE" OR "Sent Invite" OR "Sent re-Invite"
| eval XCount= if(match(_raw,"Received INVITE"),1,0)
| eval YCount= if(match(_raw,"Sent Invite" ),1,0)
| eval ZCount= if(match(_raw,"Sent re-Invite"),1,0)
| eval TCount= 1
| eval UCount=XCount+YCount+ZCount
| bucket _time span=1s
| eventstats count as CountSum, sum(TCount) as TSum, sum(UCount) as USum, sum(XCount) as XSum, sum(YCount) as YSum, sum(ZCount) as ZSum by _time
| where TSum != USum | chart sum(USum) as count over _time
... View more