Having this initial query I obtain a list of results order by Consumer, and pod messages_number container_name="pol-sms-amh-throttler" | stats avg(messages_number) as consumer_node by Consumer, pod     Then I append a second stats where I want to sum all the values of pods by Consumer messages_number container_name="pol-sms-amh-throttler" | stats avg(messages_number) as consumer_node by Consumer, pod | stats sum(consumer_node) as AvgConsumption by Consumer limit=0   Is this query correct and accurate about what I'm want to achieve?    Also I don't know how can I see the AvgConsumptions  in a visualization ... View more

I´m making a union of two search, and now I´m trying to make a subtract of the two variables.   | set union [search "Output MeshRequestId" | stats avg(time) as avgTimeOut ] [search "Input MeshRequestId" | stats avg(time) as avgTimeInt ] |stats count(eval(diff=avgTimeOut-avgTimeInt)) as TimeInThrottler   Everything fine before the latest count. I can see the definition of two avg variables. But when I do the stats count(eval(diff=avgTimeOut-avgTimeInt)) as TimeInThrottler Always return 0. Any idea what is wrong ... View more

I'm trying to calculate the milliseconds between two events by same transactionId, and then show in a timechart Here my current query   "My event 1" | stats latest(_time) as time_login by transactionId |join transactionId [search "My event 2" | stats latest(_time) as time_finish by transactionId] | eval difference=time_finish-time_login   This query works really slow and half of the time it does not work, but if I try to add this to the end of the query   | timechart avg(difference)  ... View more

So basically I want to make a subquery where I can use the values founded in the first query to make a subtract from the second subquery external_response=Time so the idea is get the subquery sum all times for traceId and then subtract the external_time Any idea how to accomplish this? sourcetype="service_ppe" source="/var/log/httpClient*.log" | stats sum(time_ms) as external_response by trace_id | join external_response [search sourcetype="service_ppe" source="/var/log/request*.log" | stats sum(time_ms) as response by trace_id | eval price_response=(response - external_response) | timechart count(price_response) ] Regards. ... View more