Hello, I have multiple queries with small differences, is it possible to combine them? Here is example: index=some_index sourcetype=some_source host=*host* (span_name=SomeSpanName1) | eval duration=span_duration/1000 | stats p99(duration) index=some_index sourcetype=some_source host=*host* (span_name=SomeSpanName2 OR span_name=SomeSpanName3) | eval duration=span_duration/1000 | stats p99(duration) index=some_index sourcetype=some_source host=*host* (span_name=SomeSpanName4) | eval duration=span_duration/1000 | stats p99(duration) The result of each query is only one column p99(duration) with value. Is it possible to combine these queries and get a result with three columns with different names (I need to know the correspondence of each column to the condition)? ... View more

Hello, I have ~15 the same queries with a little difference: (index=SOME_INDEX sourcetype=SOME_SOURCE source=... | eval API=CASE(searchmatch("xxx"), "yyy", ...) | search API=WebResponse | eval Status=case(...) | stats avg(dur) AS Avg by status_code | stats count by status_code ... (index=SOME_INDEX sourcetype=SOME_SOURCE source=... | eval API=CASE(searchmatch("xxx"), "yyy", ...) | search API=AppResponse | eval Status=case(...) | stats avg(dur) AS Avg by status_code | stats count by status_code So, all my queries are different only in one place - | search API=XXX and return result like: | status_code | count | | 201 | 10 | | 404 | 28 | etc How I can combine all above queries into one and get result as (or something like this): | status_code | count(AppResponse) | count(WebResponse) | count(Other) | | 201 | 10 | 0 | 0 | | 404 | 28 | 3 | 0 | ? ... View more