i took the query you suggested and add some other part but it is not returning any results (also for 1 hour) this part returns results : index=clientlogs sourcetype=clientlogs Mode=Real ApplicationIdentifier="*" "orders-for-open" (Action="OpenPositionRequest" AND Level=Info)
| eval StartTime=if(searchmatch("\\\"orders-for-open\\\" (Action=\\\"OpenPositionRequest\\\" AND Level=Info)"),strptime(ClientDateTime,"%Y-%m-%dT%H:%M:%S.%3N"),null())
| eval finishTime=if(searchmatch("(Message=\\\"Trading.Position.Open\\\" AND (PushEventData_Position_OrderType=17 OR PushEventData_Position_OrderType=18))"),strptime(ClientDateTime,"%Y-%m-%dT%H:%M:%S.%3N"),null())
| rename Request_Id AS RequestId
| stats min(StartTime) as StartTime min(finishTime) as finishTime min(_time) AS _time BY RequestId but when im adding this part there are no results : | eval Latency=finishTime-StartTime
| where Latency>0
| timechart avg(Latency) span=1m
... View more