@tac24 can you not override the source field even before the collect command with the value you need? | eval source= [<yourQueryToGetNewSource>] | collect <yourCommandArguments> ... View more

As dwaddle says, the only guarantee is time. Events with the exact same timestamp may or may not be returned in the same order in which they appear in the original file. ... View more

hey you can try something like this ... |stats values(a) as a_list by reason |mvexpand a_list |collect index=test_index and then try index=test_index I have re-arranged your query by adjusting and removing unnecessary commands! let me know if this helps! ... View more

As regards the _time field, min = earliest and max = latest so that change is meaningless/harmless. Because you switched from reply to request to trigger the sessionID , you needed to remove both the reverse lines, which you did correctly. ... View more

Thank you very much, it worked! Excuse me, my question is rather ambiguous. I would like to add something for beginners like me... To get weighted-average finally, after eventstats , the following commands can be added. | eval w_avg_of_ratio1_per_group = ratio1*samples/total | stats sum(w_avg_of_ratio1_per_group) as w_avg_of_ratio1 ... View more

Hi maciep, thanks for your answer and sorry for the late response. Your understanding is right and your suggestion, autoregress source as prevSource p=1 , helps great! By using it, I can easily find the source boundaries where I can select eval conditions. It seems that appendcols [subsearch with “by source”] style search is not necessarily adequate for this type of applications; calculations per site from per site source files. I think I am almost near the goal and when I finish, I will report again. Thanks again. ... View more

If the "series of search" is the same for all different sources, then you don't need a macro, although you could build one for the "source=" list below. Try this - index=… sourcetype=… (source=filename1withinzip OR source=filename1withinzip OR source=filename1withinzip ...) | series of search | stats perc50(X) dc(Y) values(Z) by source ... View more