Hi @sivaranjani Just carry the existing logic through but for the next value. Like this... | makeresults | eval _raw="{
\"Detail\": {
\"Id\": 12345678,
\"RequestCompleteTS\": \"2023-04-27T15:59:30.6960113-04:00\",
\"Steps\": {
\"0-step1\": 32,
\"0-step2\": 15,
\"3-step3\": 33,
\"4-step4\": 49,
\"5-step5\": 15,
\"6-step6\": 9,
\"7-step7\": 8
},
\"StepsCnt\": 18,
\"TargetRegion\": \"BRD\"
},
\"LogType\": \"Info\",
\"Message\": \"Success\",
\"Time\": \"2023-04-27 15:59:30.696--04:00\""
``` ^^^ create dummy event ^^^ ```
| spath
| rename Detail.Id AS Id Detail.Steps.* AS *
| foreach *step* [ eval Steps=if(isnull(Steps), '<<FIELD>>', mvappend(Steps, '<<FIELD>>')) ]
| eval steps_list_ordered=mvmap( mvsort(mvmap(mvdedup(Steps), len(Steps) . "-" . Steps)), substr(Steps, 3) )
,maxtime=mvindex(steps_list_ordered, mvcount(steps_list_ordered)-1)
,nextmaxtime=mvindex(steps_list_ordered, mvcount(steps_list_ordered)-2)
| foreach *-step* [ eval "maxstep"=if('<<FIELD>>'=maxtime, "<<FIELD>>", if(isnotnull('maxstep'), 'maxstep', null()))
,"nextmaxstep"=if('<<FIELD>>'=nextmaxtime, "<<FIELD>>", if(isnotnull('nextmaxstep'), 'nextmaxstep', null()))
]
| rename maxstep AS "Step that is taking maximum time" nextmaxstep AS "Step that is taking next maximum time"
| table Id "Step that is taking maximum time" maxtime "Step that is taking next maximum time" nextmaxtime You may want to table or rename the output to match what you want exactly. Hope that helps
... View more