| makeresults | eval sample="0,73,103,171,119" | makemv delim="," sample | mvexpand sample | streamstats count | eval time_arg="+".count."h@h" | eval time=relative_time(_time,time_arg) | rename time as _time | table _time sample count `comment("this is sample data")` | eval myFlag=if(count % 2 == 1,"true", "false") | eventstats max(eval(if(myFlag=="false",sample,0))) as max_error_value, count(eval(myFlag=="false")) as error_count Hi, all. From the example sentence, this is the query. However, it appears that there are other columns in the presented query. I can't make an exact query without knowing what it is. ... View more