Given that you only appear to be interested in the fields in importMetrics, you can remove the other fields and then use wildcards | rex field=line "(?<=<<METRIC-START>>)(?<importMetrics>.*)(?=<<METRIC-END>>)" | spath input=importMetrics | fields - line importMetrics | timechart span=1h max(*) as * ... View more

Try it this way around | bin _time span=24h | stats max(total_time) as max_time by _time customer | timechart span=24h avg(max_time) as average ... View more