@richgalloway Thank you so much!! I was able to implement your solution as a join. This is a problem that I ran into with splunk previously where if you do a stats avg then it collapses your original field into nothing and only shows the average. I was able to do a join and it works now! For reference here is the solution that works: index="a" (addinventory OR SWAPinventory OR removeinventory ) InboundInventoryChangeElement | eval addTime = if(actionelementname=="AddInventory",strftime(strptime(length,"%H:%M:%S.%f"),"%S.%f"), null()) | eval swapTime = if(actionelementname=="SwapInventory",strftime(strptime(length,"%H:%M:%S.%f"),"%S.%f"), null()) | eval removeTime = if(actionelementname=="RemoveInventory",strftime(strptime(length,"%H:%M:%S.%f"),"%S.%f"), null()) | where (isnotnull(addTime) OR isnotnull(swapTime) OR isnotnull(removeTime)) | table _time, addTime, swapTime, removeTime | join[ search index="a" (addinventory OR SWAPinventory OR removeinventory ) InboundInventoryChangeElement | eval addTime = if(actionelementname=="AddInventory",strftime(strptime(length,"%H:%M:%S.%f"),"%S.%f"), null()) | eval swapTime = if(actionelementname=="SwapInventory",strftime(strptime(length,"%H:%M:%S.%f"),"%S.%f"), null()) | eval removeTime = if(actionelementname=="RemoveInventory",strftime(strptime(length,"%H:%M:%S.%f"),"%S.%f"), null()) | stats avg(addTime) as AverageAddTime, avg(swapTime) as AverageSwapTime, avg(removeTime) as AverageRemoveTime ]
... View more