Hello Friends, I have an interesting query that I would like help on. I have three transactions that we are tracking and I would like to create a graph that has the three transaction time categories and their averages. I am able to graph the three graphs together, and I can do their average individually, but I need help combining them together. My code to show all of the different graphs are: |multisearch [search ( index="a" addinventory InboundInventoryChangeElement ) | eval addTime = if(actionelementname=="AddInventory",strftime(strptime(length,"%H:%M:%S.%f"),"%S.%f") ,length) |where addTime>0 ] [search ( index="a" SWAPinventory InboundInventoryChangeElement ) | eval swapTime = if(actionelementname=="SwapInventory",strftime(strptime(length,"%H:%M:%S.%f"),"%S.%f") ,length) |where swapTime>0 ] [search ( index="a" removeinventory InboundInventoryChangeElement ) | eval removeTime = if(actionelementname=="RemoveInventory",strftime(strptime(length,"%H:%M:%S.%f"),"%S.%f") ,length) |where removeTime>0 ] |table _time, addTime, swapTime, removeTime And here is my search for the averages. index="a" addinventory InboundInventoryChangeElement | eval addTime = strftime(strptime( length,"%H:%M:%S.%f"),"%S.%f") |where addTime>0| table _time, addTime | join [ search index="a" addinventory InboundInventoryChangeElement | eval addTime = strftime(strptime( length,"%H:%M:%S.%f"),"%S.%f") |where addTime>0 |stats avg(addTime) as AverageAddTime] The other two searches are the exact same except it the variables are different for the add, swap, and remove. Any help would be greatly appreciated!  Also, if there is an easier way rather than joins and multisearches, please let me know! Thank you!!! ... View more

Hello peeps, Currently I have a list of processing times. And I am trying to create a dashboard that shows the average time, max time, and the count of how many times that action is processed. index=IndexA | stats avg(cTotal) max(cTotal) count(cTotal) by name | sort 10 -count(cTotal) Totaltime is a given header and an example is  00:00:11.567 00:00:00.727 When I run the script, I get accurate results for count and max, but the avg is not currently working. I'm thinking it's because of the time string (hours, min, sec, milisec) but if anyone has any advice on how to make the average work, I would love to hear it! ... View more

Hello, I have a search that prints out a list of numbers in this format. [144 ==> 143] [145 ==> 144] [144 ==> 145] [145 ==> 144] [144 ==> 145] [143 ==> 144] [144 ==> 143] [143 ==> 144] [144 ==> 143] [143 ==> 144] [142 ==> 143] [143 ==> 142] [144 ==> 143] I want to extract the last three digits after the ">" sign. For example, [144 ==> 143] turns into 143. Then I want a summation of those values, so I guess I need to turn it into an int. Here is what I have so far rex "==>(?<regexusers>.*)" Where regexusers is what is being saved. Any help will be greatly appreciated!! ... View more