Try something like this index=service_public service=my-service | transaction correlation_id | table correlation_id duration|append [search index=service_public service=my-service | transaction correlation_id startsWith=eval(message="Sent request to other service") endsWith=eval(message="Response received from other service") | table correlation_id duration| rename duration AS duration_other_service] | stats values(*) as * by correlation_id eval other_service_dur_perc = round(duration_other_service*100/duration,2) ... View more