THANK YOU !!!! you just misspelled starttime but thank you very much !! ... View more

Thank you for responding. Sorry if it was not clear. here's an example pf the query I try to do index="c" sourcetype="flox:app" laas_env=dev laas_file="/var/tmp/test/logs/dev.log" "Source Message Received" "_TEST01*" | xmlkv | table userId, _time the previous query works it gets all the userId(from the xml) and the initial time now I want to do something like this : for each userId index="c" sourcetype="flox:app" laas_env=dev laas_file="/var/tmp/test/logs/dev.log" "sent" "_TEST01" userId | top limit=1 _time | table userId, ( _time2 - _time) _time2 is the the time when it was sent _time is the time we received the id userId : value of the xml tag ... View more

index="c" sourcetype="flox:app" laas_env=dev laas_file="/var/tmp/test/logs/dev.log" "Source Message Received" "_TEST01*" | xmlkv | table userId, _time the previous query works it gets all the userId and the initial time now I want to do something like this : for each userId index="c" sourcetype="flox:app" laas_env=dev laas_file="/var/tmp/test/logs/dev.log" "sent" "_TEST01" userId | top limit=1 _time | table userId, ( _time2 - _time) _time2 is the the time when it was sent _time is the time we received the id userId : value of the xml tag ... View more