Hi @Aqawelska, you should calculate Finish_time-Start_time not the contrary: index="0200-pio_numb3r5_support-app" "HumanResourceImportJob" AND "transitioning from state 'Processing' to 'Succeeded'. Reason:" OR "transitioning from state 'Enqueued' to 'Processing'. Reason:" AND NOT OnStateUnapplied
| where host="AUDIINSA4919" OR host="AUDIINSA4304"
| stats
earliest(_time) AS Start_time
latest(_time) AS Finished_time
by host
| eval Latency=tostring(Finished_time-Start_time, "duration")
| table Start_time , Finished_time , Latency , host
| fieldformat Finished_time=strftime(Finished_time,"%c")
| fieldformat Start_time=strftime(Start_time,"%c") Ciao. Giuseppe
... View more