index=_internal | head 1 | fields _raw | eval _raw="Time=DDMMY ID=001 INFO Requester=Bob Time=DDMMY ID=001 INFO Request Type=Normal Time=DDMMYY ID=001 INFO Request Status=success" | multikv noheader=t | table _raw | rex "(?<comment>(?# the logic))" | kv | stats last(Time) as Time values(Requester) as Requester values(Type) as Request_Type values(Status) as Request_Status by ID ... View more

Hi @2chs, I cannot test the search but see the approach, something like this: index=xyz .... | eventstats count(serviceName) as total by serviceName | eventstats count(eval(isPolicySuccessful="true")) as successTotal by serviceName | eventstats max(TPS) as peakTPS by _time serviceName | eval peakTime=if(peakTPS==TPS,_time,null()) | chart values(total) AS total values(successTotal) AS successTotal max(TPS) AS "PeakTPS" eval(round(avg(TPS),2)) AS "AVG TPS" min(TPS) AS "MinTPS" first(peakTime) as peakTime by serviceName | fieldformat peakTime=strftime(peakTime,"%x %X") Ciao. Giuseppe ... View more

I assumed the field Processed was already boolean. Try: | eval processedTrue=if(Processed=true,true,null()) | eval processedFalse=if(Processed=true,null(),true) | chart count(serviceName) as total avg(totalFrontendLatency) as elapsetime max(totalFrontendLatency) as maxelapsetime count(processedTrue) as ProcessedOK count(processedFalse) as NotProcessed   ... View more