I figured out the issue. I had to copy over my files from the original instance first before unpacking the tar file ... View more

Your comments did make some things clear to me. This is my suggested query. I've made some changes to reduce the lines of code and corrected a type in the 2nd last line (date_month should actually be date_hour). index=default source=mysql-pipe sourcetype=pipeline_logs ((message="bank** processing" OR message="bank** decompression complete") AND (msg_type="BEGIN" OR msg_type="INFO")) | eval run_id_bank=run_name.".".tag_value.".".mvindex(split(message, " "), 0) | eval stime=strptime(time_at,"%Y-%m-%d %H:%M:%S") | chart values(stime) over run_id_bank by msg_type | eval TimeDiff=(INFO-BEGIN)/3600 | eval date_hour=strftime(BEGIN,"%H") | table run_id_bank BEGIN INFO TimeDiff date_hour YOu can now validate the results first and then add following to get total TimeDiff by date_hour of the BEGIN events. index=default source=mysql-pipe sourcetype=pipeline_logs ((message="bank** processing" OR message="bank** decompression complete") AND (msg_type="BEGIN" OR msg_type="INFO")) | eval run_id_bank=run_name.".".tag_value.".".mvindex(split(message, " "), 0) | eval stime=strptime(time_at,"%Y-%m-%d %H:%M:%S") | chart values(stime) over run_id_bank by msg_type | eval TimeDiff=(INFO-BEGIN)/3600 | eval date_hour=strftime(BEGIN,"%H") | stats sum(TimeDiff) AS Sum by date_hour ... View more