Hi @Scorpion Can you try this, when you did stats the _time has gong as it associated to event. You have to aggregation functions to get the _time or group by _time, api_call. Here i have used aggregate function, renamed _time to time, And converted to human readable. index=**** source_type=** cf_app_name=** api_call="*"
| where like (api_call, "%xyz%")
| table _time,response_code, duration,api_call
| bin _time span=1d
| appendpipe
[| chart count over api_call by response_code ]
| stats sum(*) as *,count as Number_Of_Calls,perc95(duration) as perc95_duration,avg(duration) as avg_duration, earliest(_time) as time by api_call
| convert ctime(time) as time
| eval perc95_duration=round(perc95_duration,3),avg_duration=round(avg_duration,3)
| sort - time
| fields - duration,response_code
| table api_call,time,*,Number_Of_Calls --- An upvote would be appreciated and Accept solution if this reply helps!
... View more