How to add the _time failed in the output.

[rajhemant26]

Hello everyone.

Want to display the output only for the time which crosses 18 months (earliest time)

[vnravikumar]

Hi @rajhemant26

Click 101010 and paste your query. Some part is truncating

[chrisyounger]

Because _time is a special field, you will need to do this:

index=app sourcetype=mq_metric host=prod* QUEUE=DEAD.LETTER.Q OR MESSAGE.ACTION.Q
|stats p90(CURDEPTH) AS "Queue Depth" p90(MSGAGE) as "Massage Age" by QUEUE, _time | stats max(*) AS * max(_time) as _time |table _time,QUEUE,"Massage Age","Queue Depth"