If you just want to sum them, try this messages_number container_name="pol-sms-amh-throttler" | stats sum(messages_number) as TotalConsumption by Consumer limit=0 ... View more

Yep silly me the query were wrong, thanks  lot! ... View more

Hi @politrons, did you tried to do all the calculation in one stats? something like this:   "My event 1" OR "My event 2" | stats earliest(eval(if(searchmatch("My event 1"),_time,"")) as time_login latest((eval(if(searchmatch("My event 2"),_time,"")) as time_finish BY transactionId | eval difference=time_finish-time_login   the only problem (present also in your solution) is if one of the time_login or time_finish is outside the search time period. Remember that Splunk isn't a DB, so join command (that all the people coming from SQL used to use) is a command to use only when there isn't any other solution! Ciao. Giuseppe ... View more

The following search may be closer to what you want. However, you can't have a timechart at the end of this pipeline, because you have factored out _time in the stats commands. And you don't need a subsearch. sourcetype="service_ppe" source="/var/log/httpClient*.log" OR source="/var/log/request*.log" | eval type=if(match(source,"/var/log/request.*.log"),"response","external_response") | chart sum(time_ms) by trace_id type | eval price_response=response - external_response For each trace_id, this calculates the sum of the time_ms. If the time_ms comes from the httpClient log, it is added to the external_response. If the time_ms comes from the request log, it is added to the response. Finally, the difference between the two is calculated for each trace_id. The resulting table will show the trace_id, external_response, response, and price_response. If you want a timechart, exactly what do you want to see on the chart? ... View more