Your initial stats triggers a massive on-disk search, exhausting the user's dispatch space. On slack you mentioned you have a tiny duplication issue which made you add that first stats - it's probably not really relevant to your overall results. Try this:
index=redacted
| stats dc(CorrelationId) as count, avg(time_taken) as AvgTime, p99(time_taken) as p99, p95(time_taken) as p95, p90(time_taken) as p90, p50(time_taken) as p50
| foreach AvgTime p* [eval <<FIELD>> = <<FIELD>> * 1000]
Note that I've moved the eval to after the stats, then you don't have to do millions of evals for each single event.
... View more