So I already have a set of data that I can access and on which I build a chart. Under, you will find my actual result: Here is the search request used: index=cc_esm3_monitoring dataType="build_step_duration" | eval duration= "0" + substr('duration',1,7) | convert auto(duration) as duration_s | eval build_id = tostring(project) + ":" + tostring(variant) + " " + tostring(startTime) | stats list(duration) as "step duration", list(duration_s) as "step duration_s" by build_step, build_id | sort build_id | table build_id, build_step, "step duration", "step duration_s" Here is a simple event, as an example: { build_step: Total build time dataType: build_step_duration duration: 0:05:52.954656 project: project 1 startTime: 11/06/2019, 16:30:03 variant: variant1 } The problem is I can't really manage to make the visualization the way I would like. And I am not sure if what I want to achieve is even possible with the data in the format I have right now. So, my objective here would be to have on the horizontal axis of the chart the build_id (as it is right now) but I want to make a stacked column chart with each of the build_steps's durations_s. In a more understandable depiction: |----------- ------------ | |step3_s |________ |step2_s step4_s | |----------- |step1_s ________ | step1_s |______________________________________________________________________ |build_id_1 build_id_2 ... |______________________________________________________________________ The problem I have here is that the build_step names are not the same for each build and will need to be found automatically so that their duration in seconds can be stacked. ... View more