However when I look at my pie chart it looks like thisĪs you can see my issue is that the pie chart is only grabbing the first value which would be 4.03717 and nothing else. Now I'd like to filter the count by distinct userId. So far, I'm using this query to count total number of events over time: parse 'UserId\':,' as userId timeslice by 1h count by timeslice. | (RequestTimeUnder40ms/TotalRequest)*100 as RequestTimeUnder40ms I'm trying to count unique users over time. | (RequestTimeGreaterThan40ms/TotalRequest)*100 as RequestTimeGreaterThan40ms | RequestTimeGreaterThan40ms + RequestTimeUnder40ms as TotalRequest | sum(RequestTimeGreaterThan40ms) as RequestTimeGreaterThan40ms, sum(RequestTimeUnder40ms) as RequestTimeUnder40ms | if (Duration < 40, 1, 0) as RequestTimeUnder40ms timeslice 1h count by times lice sour cen ame tom cat timeslice by 5m count by times lice Output of last example: Time count trace A trace operator acts as a highly sophis ticated filter to connect the dots across different log messages. | if (Duration >= 40, 1, 0) as RequestTimeGreaterThan40ms timeslice The timeslice operator segregates data by time period. | parse "* " as TimeStamp,Subject,MachineName,RequestPath,RequestMethod,RequestSize,RequestType,Service,Duration,Stack,ErrorMessage,ErrorObject,UserName,ClientID,StatusCode,TraceIdentifier below you can see my query _sourceCategory=MyAppSource I would like to create a SUMO logic pie chart however I am having difficultu doing it with SUM totals.