https://community.splunk.com/t5/Reporting/How-can-I-use-multiple-fields-and-values-by-different-fields-of/m-p/431376#M10006 <P>try this:</P> <PRE><CODE>| eval step1_time = case(jobtype=delivery AND status=pending,Time1) | eval step2_time = case(jobtype=delivery AND status=pending,Time1) | eval step3_time = case(jobtype=delivery AND (status=delivered OR status=delivery_failed),Time2) | eval step4_time = case(jobtype=delivery AND (status=delivered OR status=delivery_failed),Time2) | eval step5_time = case(jobtype=delivery AND status=deposited,Time2) | eval step6_time = case(jobtype=delivery AND status=deposit_failed,Time2) | stats earliest(step1_time) as step1 latest(step2_time) as step2 earliest(step3_time) as step3 latest(step4_time) as step4 earliest(step5_time) as step5 latest(step6_time) as step6 </CODE></PRE> Fri, 07 Dec 2018 17:53:37 GMT kmaron 2018-12-07T17:53:37Z https://community.splunk.com/t5/Reporting/How-can-I-use-multiple-fields-and-values-by-different-fields-of/m-p/431375#M10005 <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6235i145428344CD6B765/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Hello,</P> <P>Here is my question:</P> <P>Suppose I have 4 fields, and I want to find the recorded time of each step using conditions of the fields.</P> <P>But, because there is different time and multiple fields involved, I cannot seem to get the result I want</P> <P>can someone please help me?</P> Fri, 07 Dec 2018 16:02:31 GMT https://community.splunk.com/t5/Reporting/How-can-I-use-multiple-fields-and-values-by-different-fields-of/m-p/431375#M10005 hyungjoon 2018-12-07T16:02:31Z https://community.splunk.com/t5/Reporting/How-can-I-use-multiple-fields-and-values-by-different-fields-of/m-p/431376#M10006 <P>try this:</P> <PRE><CODE>| eval step1_time = case(jobtype=delivery AND status=pending,Time1) | eval step2_time = case(jobtype=delivery AND status=pending,Time1) | eval step3_time = case(jobtype=delivery AND (status=delivered OR status=delivery_failed),Time2) | eval step4_time = case(jobtype=delivery AND (status=delivered OR status=delivery_failed),Time2) | eval step5_time = case(jobtype=delivery AND status=deposited,Time2) | eval step6_time = case(jobtype=delivery AND status=deposit_failed,Time2) | stats earliest(step1_time) as step1 latest(step2_time) as step2 earliest(step3_time) as step3 latest(step4_time) as step4 earliest(step5_time) as step5 latest(step6_time) as step6 </CODE></PRE> Fri, 07 Dec 2018 17:53:37 GMT https://community.splunk.com/t5/Reporting/How-can-I-use-multiple-fields-and-values-by-different-fields-of/m-p/431376#M10006 kmaron 2018-12-07T17:53:37Z