I think there's a missing point here, that I've adapted inside my current solution. The primary key here is not only the job name but the PID also. The job could be executed multiple time during the day or time span chosen, the search key is  talend_job and talend_pid in order to have unique duration... ... View more

If you do at - let's say - 10:35:15 a |timechart with span=1m over last 5 minutes, you'll get data from 10:30:15 to 10:35:15 split into a minute-long buckets, aligned at full minutes. So you'll get 6 buckets - one containing events from 10:30:15 to :10:31:00, another one from 10:31:00 to 10:32:00 and so on up to 10:35:00-10:35:15. Obviously, the first and last buckets will be smaller than the rest of them. That's the default behaviour of the |timechart You can however use partial=f option for |timechart wich will omit the not-full first and last buckets from the result. In our example case you'd get only four buckets - 10:31-10:32, 10:32-10:33, 10:33-10:34 and 10:34-10:35. ... View more

Solved the query part:   | chart count(eval(status>=500)) as internal_errors, count(eval(status<500)) as other_requests by host   What about the colors? Is there any way to define them?   ... View more

hi @marco_carolo, Try this and select Visualization. | eval seconds = tonumber(trim(OSY_timing)) | stats avg(seconds) as sec_avg by Query |sort -sec_avg | head 20 | table Query, sec_avg   If this reply helps you, a like would be appreciated. ... View more