Is there really no better way than this? ... View more

That's because you have a stats command that does not include the _time field. Change the stats command to eventstats . So you search will look like this index=prt result=* | eventstats c(eval(result!="")) as totalOp c(eval(result="OK")) as okOp by operation | eval ratio=1-okOp/totalOp | eventstats max(ratio) as ratio by operation | timechart count(operation)max(ratio) by result | sort 3 -ratio | head 1 ... View more