Thanks for the document. I am not able to optimize the below query : index=server sourcetype="performance"  source="*/performance.log" perf_component_role=kafkaProducer component_name="test-api-v1" event_status=COMPLETE  | eval publishedtime=_time | join app_correlation_id [search index=server component_name="test-api-v2" environment=sit1 "Process updated Successfully !!" | eval processedtime=_time] | eval endToEndTime = (processedtime -publishedtime) | table app_correlation_id publishedtime processedtime endToEndTime ... View more

I have tried using the technique you have given me for the below query but it is not working. The below query will be used to calculate the time difference of an event logged in 2 different sources which has common correlation id. Since I am using join it is taking longer time. Basically I am trying to find out the end to end time involved for a message which started from Kafka producer and processed by a consumer. index=server sourcetype="performance"  source="*/performance.log" perf_component_role=kafkaProducer component_name="test-api-v1" event_status=COMPLETE  | eval publishedtime=_time | join app_correlation_id [search index=server component_name="test-api-v2" environment=sit1 "Process updated Successfully !!" | eval processedtime=_time] | eval endToEndTime = (processedtime -publishedtime) | table app_correlation_id publishedtime processedtime endToEndTime ... View more

Thanks.. It is partially working. However, would you please explain how the steps you have taken to form the query? What shall I do if the field name used for correlation is same in both the sources?  ... View more