search A | eval Date=strftime(_time, "%d/%m/%Y") | stats latest(_time) AS Latest by Date | join Date [search search B | eval Date=strftime(_time, "%d/%m/%Y") | stats earliest(_time) AS Earliest by Date ] | eval timediff=Latest-Earliest | eval duration_mail=tostring(timediff,"duration") | eval Endtime_mail=strftime(Latest,"%Y/%m/%d %H:%M:%S") | eval starttime_mail=strftime(Earliest,"%Y/%m/%d %H:%M:%S") | table starttime_mail,Endtime_mail,duration_mail ... View more

I'm sorry I should have been more clear. Add the eval statement I provided to the search you used that generated the results. Given that your results have the fields 'Total Time Taken' and 'Total Records', it will work. ... View more

Hi @paragvidhi, you could try something like this: index=your_index | rex field=ServerName "\w+\d(?<Node>a|b)" | eval Node="Node ".Node | table ServerName Node You can test the regex at https://regex101.com/r/jLeU1f/1 Ciao. Giuseppe ... View more

source=xyz | stats values(login_session), values(logout_session) by client ... View more

@renjith.nair , Thanks for your help it's working for me thanks a lot ... View more