Hey, I have an index 'test_iterations' which contains test data (start time, end time, iterationIndex ane TestName). Each Test can appear more than once but with different iteration index I need to get the test duration, which is the sum of the duration of each iteration I used this query to find for a single test: Index="test_iteration" TestRunId=someId TestName=someTestName | dedup IterationIndex | eval sum = 0 | foreach IterationIndex* [ eval sum = sum + strptime(EndTime, "%Y-%m-%d%H:%:M%:S.%N") - strptime(StartTime,  "%Y-%m-%d%H:%:M%:S.%N")] | table sum Which provide me the right answer   But when I try to get all the tests duration in a run, I get an error. My search: Index="test_iteration" TestRunId=someTestRunId | dedup TestName |  Eval dur = [ search Index="test_iteration" TestRunId=someId TestName=someTestName | dedup IterationIndex | eval sum = 0 | foreach IterationIndex* [ eval sum = sum + strptime(EndTime, "%Y-%m-%d%H:%:M%:S.%N") - strptime(StartTime,  "%Y-%m-%d%H:%:M%:S.%N")] | table sum] | table Duration, TestName   I get the error: error in 'eval' command: the expression is malformed. An unexpected character is reached at ')'.   But I don't get why?   Thanks. ... View more

Hey there. I have a dashboard with a search query: Index=my index TestRunId="$RunId$" | dedup TestName | eval Status=case(Outcome==0, "Failed, Outcome==1, "Passed") | table TestName I want to keep the Outcome per row in a token to enable coloring the test name with his outcome. How can I do it? Or does there is a way to table both the TestName and the Outcome but not show the outcome, and color the row based the outcome value?   Thanks. ... View more