How can I take multiple fields and time values and combine them into one?

[hyungjoon]

Suppose I have 4 fields

fields= "jobtype" values= A,B
fields= "status" values=1,2,3,4,5,6
fields= "Time1" values=.....................
fields= "Time2" values=.....................

I want to create a full day timestamp using the fields I have

(example)

Step 1 =    jobtype=A ,status=1 **earliest of Time1**       
Step 2 =    jobtype=A ,status=1 **latest of Time1**     
Step 3 =    jobtype=A, status=2 Or status=3 **earliest of Time2**       
Step 4 =    jobtype=A, status=2 Or status=4 **latest of Time2**     
Step 5 =    jobtype=B, status=5 **earliest of Time2**       
Step 6 =    jobtype=A, status=6 **earliest of Time2**   

Result would look something like this on one sheet

Step1---------- Step2------------ Step3--------- Step4------------ Step5---------- Step6

min(Time1) ---max( Time1)---min(Time2)-- max(Time2)----min(Time2)---min(Time2)

Because There is multiple fields and values involved, I cannot seem to get the right answer. Please help me

[astein_splunk]

Something like this? also it helps if you can share some mockup data or build it with makeresults . The only line below you should care about is xyseries I suspect. you may need a stats for this "max" requirement

| makeresults count=2
| streamstats count as count
| eval time=case(count=2,relative_time(now(),"+2d"),count=1,now())
| makecontinuous time span=15m
| eval _time=time
| eval job=if( random()%2==1,"JobA","JobB")
| streamstats count by job reset_on_change=true
| xyseries count, job, _time

Alternatively you may mean (you only care about the |Stats and |xyseries parts )

| makeresults count=2
| streamstats count as count
| eval time=case(count=2,relative_time(now(),"+2d"),count=1,now())
| makecontinuous time span=15m
| eval _time=time
| eval job=if( random()%2==1,"JobA","JobB")
| streamstats count by job reset_on_change=true
| stats max(_time) by count, job
| xyseries job, count, max(_time)