I have 2 indexies: one with business events [main], another with server performance metrics [metrics]. Say, in [main] I have information about long-running processes with fields Name, Host, StartTime, EndTime, .... How to display mean CPU utilization during process execution? I need something like ... Host=$host$ | eval cpu = [ mstats avg(win_cpu.Percent_Processor_Time_mean) as psCpu where index=metrics  host=$host$ AND starttime=StartTime AND endtime=EndTime | return $psCpu] | table Name cpu Unfortunately this approach isn't works since subquery knows nothing about main query result fields and I got "Unable to parse StartTime with format ..." May be it's possible somehow to make main query by [metrics] and filter/group by time intervals [StartTime;EndTime] from subquery results from [main]? ... View more