hello there,
tried your search, it works on my dummy data.
can you verify again?
| gentimes start="08/18/2018:00:00:00" end="08/18/2018:00:10:00" increment=2s
| eval _time = starttime
| eval R = random()%500
| eval THREAD_WALL_MS = random()%1000
| eval host = random()%3
| eval host_type = case(host=1,"some_type",host=2,"other_type",host=0,"deferent_type")
| rename COMMENT as "the above generates sample data, below is your query"
| bucket span=10min _time
| stats count(R) as Requests, max(THREAD_WALL_MS) as "TotalResponseTime", avg(THREAD_WALL_MS) as avg_rt by host_type _time
|eval avg_rt=round(avg_rt,2)
|eval TotalResponseTime=round(TotalResponseTime,2)
|rename avg_rt as "AvgResponseTime"
|eval Throughput=(TotalResponseTime/Requests)
|dedup 1 host_type
|rename host_type as "Server"
|sort Server
hope it helps
