Hi Dal, thank you very much for your response. when i replace my code with
index=foo Customer="xyz" (ID=xvalue OR ID=yvalue)
| bin _time span=1m
| xvalue=if(ID=xvalue,Value,null())
| yvalue=if(ID=yvalue,Value,null())
it didn't work. I got an error message: Unknown search command 'xvalue'. Would you mind to share with me how to resolve it? Thank you very much
... View more