Hello You have two different formatted tables. You might want to transform the structure either on first search or second. first_search
| join type=left Schicht_Datum [ second_search | untable Schicht_Datum segment mid_result ]
| xyseries Schicht_Datum segment mid_result
... View more
Hi @crmarley20, good for you, see next time! Please accept my answer for the other people of Community. Ciao and happy splunking. Giuseppe P.S.: Karma Points are appreciated 😉
... View more
Try saving the duration from each event in either technicalDuration, organisationalDuration and qualityDuration depending on the type of error in the event. Then use stats to sum these separate durations.
... View more