Hello,   With Appendcols I now have both values in one line. However, I would like to compare the values with each other. As an example: "mysearch " stats dc(User) as User1 | appendcols [search "my2search" | stats dc(User) as User2 ] Now as result I get User1 User2 500     1000 Now I would like to compare the two values in the same query, for example multiply User1 with User2 or similar. How can I include this in the search?   ... View more

Hello, I want to compare the value of the week before last with the value of my search (last week) and put the percentage growth/decrease in the result. Currently I can display the value of the previous week to me and in another search the value of the week before last. However, I cannot compare the two values. My query looks like this: In search I set last week "..." | stats count as lastweek | append [search"..." earliest=-14d latest=-7d | stats count as lastweek1 Result: Lastweek         lastweek1          XX                                 XX Desired Result: Lastweek             lastweek1            Change XX                             XX                           50% This gives me two values, but I can't compare them, at least I don't know how. Of course it would be even more elegant if I had the value already in the first query without having to use append. Is there a solution, that I have the values of the previous week in the same query, so that I can compare both values?   ... View more

Hello, I have a query (e.g. "....... " | stats count, avg(...)) and after that I get as result OwnColumn Count AVG XYZ                 20           40 As another column I would like to have the time of my request (last week, last 24 hours), depending on what I selected. And that in readable time. Now I found the following command to show me the time. | addinfo | convert ctime(*) | eval reportDate=info_min_time." to ".info_max_time | table reportDate | rex field=reportDate "(?<FirstPart>.*\d+:\d+:\d+).*\s+to\s+(?<SecondPart>.*\d+:\d+:\d+)" | eval reportDate=FirstPart." to ".SecondPart | fields reportDate I customized it the query : "fields OwnColumn, reportDate, count, AVG..." so I can see my queries in the dashboard. So requested would be OwnColumn reportDate                                                                               count         AVG XXX                 02/21/2021 00:00:00 to 02/28/2021 00:00:00      20                40 However, I either get only the reportDate and all the others remain empty or it converts the data from the other queries also into a date, so that 43 (which was for example in count) then also becomes a date. How do I change the query to get what I want?   ... View more

Hello, I have a query (e.g. "....... " | stats count, avg(...)) and after that I get as result Count avg 20        40 What I would like to have before that is a separate column that I can name myself. So desired: OwnColumn Count AVG XYZ                 20           40 How can I include this in my query? ... View more

Hello, i think its not that difficult, but i dont know how to do it.   The result is in milliseconds. Is there an easy way to convert these milliseconds into seconds?   Best regards ... View more