How do I add a new field in the output?

[rajhemant26]

Hello everyone.

Want to display the output only for the time which crosses 18 months (earliest time)

[Vijeta]

In your stats command you can add Req in by clause, if that is what you want as output . See below-

 stats avg(RequestsPerSec) as AvgRequestsPerSec , max(RequestsPerSec)  as MaxRequestsPerSec , p95(RequestsPerSec) as P95RequestsPerSec  by Req host_type _time

[Vijeta]

You can use bin and stats instead of timechart-

 host=pcde* sourcetype=qwedc

 | eval host_type=case(host LIKE "%raf%", "RAF", host LIKE "%tap%", "TAP", host LIKE "%dft%", "DFT" 
 | streamstats count as Req by host_type 
 | eval RequestsPerMin=Req/24/60
 | eval RequestsPerSec=RequestsPerMin/60
|bin span=5m _time| stats avg(RequestsPerSec) as AvgRequestsPerSec , max(RequestsPerSec)  as MaxRequestsPerSec , p95(RequestsPerSec) as P95RequestsPerSec  by host_type _time
 |eval AvgRequestsPerSec=round(AvgRequestsPerSec,2), MaxRequestsPerSec=round(MaxRequestsPerSec,2), P95RequestsPerSec=round(P95RequestsPerSec,2) 
 |sort -MaxRequestsPerSec, -P95RequestsPerSec