index="filtereduiauditlogs" | stats count(ip) as "Count" by ip | appendcols [search index="filtereduiauditlogs" |iplocation ip | table Country,City,ip | dedup ip] |appendcols [search index="filtereduiauditlogs" | stats avg(responsetime) by ip ] | rename ip as "Client Ip" | rename avg(response_time) as "Avg Response Time(ms)"
When I execute this query for the Relative time frame (eg, last 15 min or All time), the following fields are shown as expected(Refer to image).
Client Ip, Count, Avg Response Time(ms), City, Country
But when I change the time frame to real time in time range picker, then it only shows 2 columns - Client Ip and Count only.
like @woodcock said, don't do real time when using appendcols because in general, every subsearch finishes before the main search starts. Real-time searches do not finish, hence subsearches cannot be real-time.
Also, you are doing three times the same search ... why not simply do this:
| stats count values(*) AS * by ip
| iplocation ip
| do more SPL fu