try like : ... | rename FirstSourceType as "Total Time Taken" , SecondSourceType as "Total time taken by zzz" |... you can try like this in your case : index=xxx earliest=-7d@d latest=@d ( sourcetype="FirstSourceType" ResponsePayLoad="*xxx*" ActivityStep="rs" (ResponseStatus!=500 OR ResponseStatus!=400) ) OR ( sourcetype="SecondSourceType" OperationName=CSRequestProcessor.post ActivityStep="rs" ResponseStatus=0) | eval txn_id=if(transaction_id LIKE "[%]", substr(transaction_id, 2, 36) , transaction_id) | chart sum(Duration) over txn_id by sourcetype |replace FirstSourceType with "Total Time Taken" in sourcetype |replace SecondSourceType with "Total time taken by zzz" in sourcetype ... View more

You're really close. I think all you need to do is remove OperationName from your chart command | chart values(Duration) over txn_id ^ However, looking at your serach, I'm guessing that you actually want to use list(Duration) instead of values(Duration) since it looks like you want to know the value for each and every txn_id regardless of uniqueness. Using values will list the value if it hasn't seen it before (it is a unique list). So for example, if two of your txn_id 's had the same value, like 5 , you'd only see it listed once from the values() function whereas list() doesn't care and just lists out the values, even if things are repeated. ... View more