You could try something like this index=x message.message="Response sent" message.feedId="v1" | stats count as Produced | appendcols [ search index=y | spath RenderedMessage | search RenderedMessage="*/v1/xyz*StatusCode*2*"| stats count as Processed] | appendcols [ search index=z message.feedId="v1" | stats avg("message.durationMs") as AverageResponseTime] | eval AverageTimeLeft = (Produced - Processed) * AverageResponseTime Note that I think your calculation should be a multiplication not a division

This is an example based on your example dataset It assumes that there is a lookup file requests.csv (which I generated using the second code snipped below) The makeresults stuff just sets up your data, so assume your search runs up to the inputlookup statement below. | makeresults | eval _raw=split(replace("time,os,host,user 1/10/2023 9:00,Linux,Server1,UserA 1/10/2023 11:00,Linux,Server1,UserA 1/10/2023 12:00,Linux,Server2,UserA 1/10/2023 9:00,Linux,Server2,UserB 1/10/2023 14:00,Linux,Server1,UserA","\n","###"),"###") | multikv forceheader=1 | eval _time=strptime(time, "%d/%m/%Y %k:%M") | table _time,os,host,user | inputlookup append=t requests.csv | eval user=coalesce(user, reporterName) | foreach change* [ eval <<FIELD>>=strptime('<<FIELD>>', "%d/%m/%Y %k:%M") ] | stats list(_time) as _time values(key) as key values(reporterEmail) as reporterEmail values(summary) as summary values(changeStartDate) as changeStartDate values(changeEndDate) as changeEndDate by user host | eval isInside=mvmap(_time, if(_time>=changeStartDate AND _time<changeEndDate, _time.":1", _time.":0")) | mvexpand isInside | rex field=isInside "(?<_time>[^:]*):(?<isInside>\d)" the logic is then that it appends the contents of the lookup file to the end of the data and makes the common name (user or reporterName) and then converts the change time fields to epoch. Then the stats function joins all the items together - there is an assumption that there is only one requests in requests.csv for each user/server - if more then the logic will need to change. After the stats, the mvmap just compares the times and then expands out the results with isInside showing if the event is inside the request period    Here's the csv generation so you can test if needed. | makeresults | eval _raw=split(replace("key,host,reporterName,reporterEmail,summary,changeStartDate,changeEndDate REQ-1000,Server1,UserA,UserA@dummy.com,Investigate error,1/10/2023 8:00,1/10/2023 13:00 REA-1001,Server2,UserB,UserB@dummy.com,Reset service,1/10/2023 8:00,1/10/2023 10:00","\n","###"),"###") | multikv forceheader=1 | table key,host,reporterName,reporterEmail,summary,changeStartDate,changeEndDate | outputlookup requests.csv