Hi @danielbb You could start with something like this: index=_audit action=search info=completed search_et!="N/A"
| eval time_span=search_lt-search_et
| eval time_span_group=case(
time_span<3...
See more...
Hi @danielbb You could start with something like this: index=_audit action=search info=completed search_et!="N/A"
| eval time_span=search_lt-search_et
| eval time_span_group=case(
time_span<3600, "<1hr",
time_span>=3600 AND time_span<7200, "1-2hrs",
time_span>=7200 AND time_span<43200, "<12hrs",
time_span>=43200 AND time_span<86400, "<24hrs",
time_span>=86400 AND time_span<259200, "<3days",
time_span>=259200 AND time_span<604800, "<7days",
time_span>=604800 AND time_span<2592000, "<30days",
time_span>=2592000 AND time_span<7776000, "<90days",
time_span>=7776000 AND time_span<31536000, "<1year",
time_span>=31536000, "more"
)
| stats count by time_span_group Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing