Try something like this (this assumes that you want daily results based on when the get was received, rather than the put, if this is different, change the bin command to use the other field) index=myindex source=mysoruce earliest=-7d@d latest=@d | eval PPut=strptime(tomcatput, "%y%m%d %H:%M:%S") | eval PGet=strptime(tomcatget, "%y%m%d %H:%M:%S") | stats min(PGet) as PGet, max(PPut) as PPut, values(Priority) as Priority by TRN | eval tomcatGet2tomcatPut=round((PPut-PGet),0) | eval E2E_5min=if(tomcatGet2tomcatPut<=300,1,0) | eval E2E_20min=if(tomcatGet2tomcatPut>300 and tomcatGet2tomcatPut<=1200,1,0) | eval E2E_50min=if(tomcatGet2tomcatPut>1200 and tomcatGet2tomcatPut<=3000,1,0) | eval E2EGT50min=if(tomcatGet2tomcatPut>3000,1,0) | eval Total = E2E_5min + E2E_20min + E2E_50min + E2EGT50min | bin PGet as _time span=1d | stats sum(E2E_5min) as sum_5min sum(E2E_20min) as sum_20min sum(E2E_50min) as sum_50min sum(E2EGT50min) as sum_50GTmin sum(Total) as sum_total by _time Priority | eval good = if(Priority="High", sum_5min, if(Priority="Medium", sum_5min + sum_20min, if(Priority="Low", sum_5min+ sum_20min + sum_50min, null()))) | eval Per_cal=round(100*good/sum_total,1) | xyseries _time Priority Per_cal   ... View more

Using SHOULD_LINEMERGE=true is performance ineffective. Use the below configuration. SHOULD_LINEMERGE = false LINE_BREAKER = ([\s\n\r]+)[0-9]+\/[0-9]+\/\d{4}\s[0-9]+:[0-9]+\s[P|A]M\s+ TZ = EST TIME_PREFIX = ^ TIME_FORMAT = %m/%d/%Y %I:%M %p MAX_TIMESTAMP_LOOKAHEAD = 25   By the looks of it from the data you pasted, it is not necessary to have all the events in a new line. But if that is the case (each event in a new line) then updating the LINE_BREAKER below will improve performance and reduce the chances of incorrect line-breaking. ([\n\r]+)[0-9]+\/[0-9]+\/\d{4}\s[0-9]+:[0-9]+\s[P|A]M\s+   I hope this helps!!! ... View more