I am combine two queries and calculating the percentage but.

[rajhemant26]

Hello everyone.

Want to display the output only for the time which crosses 18 months (earliest time)

[FrankVl]

I took the liberty of editing your question, to put the search code as code, such that special characters like * don't disappear.

Couple of observations

1. You're not just combining 2 queries, you're combining many more, with all those append statements
2. You're using quite a few != filters, including also wildcards. Such negative filters are significantly slower than positive filters.
3. You're pulling a lot of data together, doing some evals on different pieces. But in the end, all you do is a stats count as release1 which you then join with the second part, which ends with table Percent. Can you perhaps explain what you are trying to achieve here? It doesn't make a whole lot of sense to me.
4. The search on the right side of your join calculates a percentage based on release2 - release1. But release1 is only defined on the left side of the join, so that calculation will never work like that. Shouldn't that last ] be before the | eval Percent... part?

So apart from the general remark on the != filters, I think we need some more explaining on what you are trying to achieve, before anyone can give a proper answer on how to improve your query.

[martin_mueller]

append and join aren't meant to be used like that.

earliest=1520640000 latest=1531526400 
(index=app host="prod*"  AND host= "*web*" OR host= "*wap*" _raw!="" AND _raw!="*sql*" AND exception!="*db2*" AND exception !="*solr*" error) OR
(index=app host="prod*" MQ _raw="*ERROR*" _raw!="*INFO*") OR
(index=app host="prod*" exception="*sql*" sqlserver OR db2) OR
(index=datatier riak sourcetype=kvs_console "\[error\]" host="prod*") OR
(index=datatier host="*prod*" source="*memsql*"  "ERROR") OR
(index=datatier OR index=app sourcetype="solr_log" SEVERE OR ERROR)
| stats count(eval(_time < 1526688000)) as release1 count(eval(_time >= 1526688000)) as release2 
| eval Percent = ((release2-release1)/ release1)*100  |table Percent

This will search your data in one go and count right away, instead of appending huge lists of raw data to each other

[martin_mueller]

The next step is to figure out which part is taking up too much time. Run each segment individually:

earliest=1520640000 latest=1531526400 
(index=app host="prod*"  AND host= "*web*" OR host= "*wap*" _raw!="" AND _raw!="*sql*" AND exception!="*db2*" AND exception !="*solr*" error)
| stats count

Post the resulting count plus these values from the job inspector: scan count, run duration (or run time?).