https://community.splunk.com/t5/Splunk-Search/help-to-timechart-after-an-append-command/m-p/589069#M205151 <P>Hi Gcusello, good idea thanks</P> Tue, 15 Mar 2022 12:28:31 GMT jip31 2022-03-15T12:28:31Z https://community.splunk.com/t5/Splunk-Search/help-to-timechart-after-an-append-command/m-p/589042#M205138 <P>hello</P><P>I use a search with the structure like below in order to timechart events from 2 different search</P><P>As you can see, I need to perc90 the events before doing a timechart</P><P>My question concerns the timechart&nbsp;</P><P>Is there a way to timechart the events without using an avg function?</P><LI-CODE lang="markup">index=toto | search abc &lt;=1000 | stats perc90(abc) as "titi" by _time | append [ search index=toto | search abc &gt;= 1000 | stats perc90(abc) as "tutu" by _time ] | timechart span=1m avg("titi") as "titi", avg("tutu") as "tutu"</LI-CODE><P>Thanks</P> Tue, 15 Mar 2022 09:44:04 GMT https://community.splunk.com/t5/Splunk-Search/help-to-timechart-after-an-append-command/m-p/589042#M205138 jip31 2022-03-15T09:44:04Z https://community.splunk.com/t5/Splunk-Search/help-to-timechart-after-an-append-command/m-p/589044#M205140 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/102660">@jip31</a>,</P><P>did you tried something like this?</P><P>&nbsp;</P><LI-CODE lang="markup">index=toto | eval kind=if(abc&lt;=1000,"titi","tutu") | timechart perc90(abc) BY kind </LI-CODE><P>&nbsp;</P><P>Ciao.</P><P>Giuseppe</P> Tue, 15 Mar 2022 09:48:26 GMT https://community.splunk.com/t5/Splunk-Search/help-to-timechart-after-an-append-command/m-p/589044#M205140 gcusello 2022-03-15T09:48:26Z https://community.splunk.com/t5/Splunk-Search/help-to-timechart-after-an-append-command/m-p/589069#M205151 <P>Hi Gcusello, good idea thanks</P> Tue, 15 Mar 2022 12:28:31 GMT https://community.splunk.com/t5/Splunk-Search/help-to-timechart-after-an-append-command/m-p/589069#M205151 jip31 2022-03-15T12:28:31Z https://community.splunk.com/t5/Splunk-Search/help-to-timechart-after-an-append-command/m-p/589085#M205154 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/102660">@jip31</a>,</P><P>good for you, see next time!</P><P>Ciao and happy splunking</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 15 Mar 2022 13:02:23 GMT https://community.splunk.com/t5/Splunk-Search/help-to-timechart-after-an-append-command/m-p/589085#M205154 gcusello 2022-03-15T13:02:23Z