Interesting! Using split you only increased the amount of values in the project field, but not duplicating the amount of events. 😄 So many ways of doing things. Thank you guys so much! ... View more

This is an interesting approach and seems to work too. In this case, I'll stick with the avg() function since there's a way to get that working. ^^^ But thank you for sharing! 🙂 ... View more

Woo~~ that's it! Thank you both so much! ... View more

oh i see. timechart was expecting the default _time field. Thanks that does make stats work with timechart. The column ordering issue still persists though. Because my project names could be after "T" for "Total". ... View more

oh~~~ this is cool! Thank you! I see what you're doing here, and the sorting is really cool. However, I can't seem to pass the result of stats into timechart (when I do, it returns no result). I had to use eventstats instead, but that nullify the sorting. 😞 And for the eventstats, I actually have to also split by date for the average to calculate properly. ... | bin time span=1d | eval sorttype=0 | appendpipe [| eval project="Total", sorttype=1] | eventstats avg(eventDuration) as avgDuration by date sorttype project | timechart span=1d avg(avgDuration) by project Do you know how I might get stats working with timechart? I'd really prefer the "Total" to be the last column, without having to come up with weird names just to satisfy the automatic alphabetical sorting. ... View more

can't seem to use TotalDuration directly in timechart Error in 'timechart' command: The specifier 'TotalDuration' is invalid. It must be in form (). For example: max(size). so I changed it to | timechart avg(TotalDuration) over avg(eventDuration) by project but then seems like over is not supported either Error in 'timechart' command: The specifier 'over' is invalid. It must be in form (). For example: max(size). ... View more

This does work for sure (although new column is not necessary the last column), but I was really hoping not to do the whole search again, hitting the index twice while the search is exactly the same. ... View more