Hi @avni26
This rightly does not work and here's why.
The first two commands albeit looking through multiple field values returns one single aggregated value whereas the values is expected to return one single multi value field of restore_duration values for Sev1 scenarios.
The below run anywhere example should work for you by virtue of creating the additional duration field. You should be able to customize it to work for your example. If you need to create a multivalue field(which is a complication), use streamstats to create a field based on severity ahead of your stats
| makeresults count=10
| streamstats count
| eval status=if(count%2>0,"true","false") , severity=if(count%2>0,2,1),restore_duration=if(count%2>0,25,30), duration=if(severity=1,restore_duration,null())
| stats count as total_count count(eval(status="true")) as status_count avg(duration) as duration
... View more