The timechart command gives you output in x-y series format with x as time and y as one single field (there can be multiple aggegated values). See the timechart documentation for details/examples. Assuming you're extracting field username and webservice name already, try something like this. index=MyWebServer (("WebService_01" OR "WebService_02" OR "WebService_03" OR "WebService_04") AND "input") OR ("WS Total time") | rename COMMENT as "If field username and webservicename is not exracted, add extraction here" | transaction TID host webservicename username startswith="input" endswith="WS Total time" | bucket span=1m _time | stats count, avg(WSTotalTimeValue) as AvgWSTotalTime, max(WSTotalTimeValue) as MaxWSTotalTime, perc95(WSTotalTimeValue) as P95WSTotalTime by _time username, webservicename OR index=MyWebServer (("WebService_01" OR "WebService_02" OR "WebService_03" OR "WebService_04") AND "input") OR ("WS Total time") | rename COMMENT as "If field username and webservicename is not exracted, add extraction here" | transaction TID host webservicename username startswith="input" endswith="WS Total time" | eval User_WS=username." - ". webservicename | timechart span=1m count, avg(WSTotalTimeValue), max(WSTotalTimeValue), perc95(WSTotalTimeValue) by User_WS ... View more

Give these a try | loadjob savedsearch="myquery" |where strftime(_time, "%Y-%m-%d") = "2020-02-24" |eval show=if(STEP="show",_time, null()) ,click=if(STEP="click",_time, null()) |stats max(show) as show ,min(click) as click by client | eval Diff=tostring(click-show,"duration") | convert ctime(click) ctime(show) timeformat="%Y-%m-%d %H:%M:%S" OR | loadjob savedsearch="myquery" |where strftime(_time, "%Y-%m-%d") = "2020-02-24" | eval {STEP}=_time |stats max(show) as show ,min(click) as click by client | eval Diff=tostring(click-show,"duration") | convert ctime(click) ctime(show) timeformat="%Y-%m-%d %H:%M:%S" ... View more

We probably need to look at your raw data to give you accurate suggestion. Here is my attempt without that (assuming user is appear in raw log after string /user_id= . Also recommend adding one or more metadata fields index/sourcetype/host/source in your query for better performance) index=foo sourcetype=bar "Looking for user based on login/user_id=" "abc123" OR "zxy987" | rex "login/user_id=(?<user_id>\S+)" | timechart count by user_id ... View more

Have a look at this really nice Splunk documentation which provides sequence of all search time operation. https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Searchtimeoperationssequence The Field Aliasing happes before Lookup, that's the reason you don't see your clienthost aliases. ... View more