so my log lines look something like this <<METRIC-START>>{"A":332,"B":45,"C":67,"D":23,"E":234,"F":435,"G":43,"H":66,"I":32,"J":67,"K":21,"L":678,"M":45,"N":56}<<METRIC-END>> It is in form of a Json and I am able to extract the fields along with time using this | rex field=line "(?<=<<METRIC-START>>)(?<importMetrics>.*)(?=<<METRIC-END>>)" | spath input=importMetrics now I wish to plot A,B,C,D as timecharts, so I will have to give this command | timechart span=1h max(A) as A, max(B) as B....till Z So the whole query works fine but I wanted to know if there is anyshort way of doing it | rex field=line "(?<=<<METRIC-START>>)(?<importMetrics>.*)(?=<<METRIC-END>>)" | spath input=importMetrics | timechart span=1h max(A) as A, max(B) as B....till Z ... View more

I am consuming some data using an API, I want to calculate avg time it took for all my customer, after each ingestion (data consumed for a particular customer), I print a time matrix for that customer. timechart span=24h avg(total_time) Now to calculate average I cannot simply extract the time field and do avg(total_time), because if customerA completes ingestion in 1 hour, and customerB takes 24 hours, customer A will be logged 24 times and B will be logged once, giving me inaccurate results and bringing down the average. How do I create a filter let's say time duration is 7 days, so I get only those log lines for a particular customer which has the maximum total_time over a period of 7 days. i.e one log line per customer that has max total_time over a period of 7 days for that particular customer. ... View more