I have result like this     column, row 1 TotalHits: Create, 171 TotalHits: Health, 894 TotalHits: Search, 172 TotalHits: Update, 5 perc90(Elapsed): Create, 55 perc90(Elapsed): Health, 52 perc90(Elapsed): Search, 60 perc90(Elapsed): Update, 39       I want to convert this into   Total Hits perc90(Elapsed) Create 171 55 Update 5 52 Search 172 60 Health 894 52   What query should I use Btw, to reach the above output I used like this, even this I am not sure whether its the best way index=xyz | search Feature IN (Create, Update, Search, Health) | bin _time span=1m | timechart count as TotalHits, perc90(Elapsed) by Feature | stats max(*) AS * | transpose Basically I am trying to get the MAX of the 90th percentile and Total Hits during a time window. ... View more

I am trying to find events based on when they were initially logged and grouped by some column. For example,  from the below table, I want find those total count of unique "keyId" that logged first group by "parent1" and using timechart April 20 | A01 | 2  (DATT-001, DATT-002 first appeared in May ) May 20 | A02 | 1   Basically first appearance of "keyId" grouped by parent1 and shown by timeline _time keyId parent1 parent2 parent3 status eventdetails 2020-04-19T23:47:21.000+10:00 DATT-001 A01 B01 C01 Pass   2020-04-20T2:47:21.000+10:00 DATT-001 A01 B01 C01 Fail   2020-05-20T2:47:21.000+10:00 DATT-001 A01 B01 C01 Fail   2020-06-20T2:47:21.000+10:00 DATT-001 A01 B01 C01 Fail   2020-04-20T2:47:21.000+10:00 DATT-002 A01 B01 C01 Fail   2020-05-20T2:47:21.000+10:00 DATT-002 A01 B01 C01 Fail   2020-05-20T2:47:21.000+10:00 DATT-003 A02 B01 C01 Fail     Any help please ? ... View more