This query does show the earliest posted_timestamp. However, all the other fields are blank for the table command for fields (event_id, process_id, msg_timestamp, lag_in_seconds) Thanks! ... View more

Thank you very much for the solution! ... View more

Thank you, how would i be able to reduce the result by only displaying the row with the earliest time (time_1 field)? Thanks! ... View more

Thanks @bowesmana  Ok let's make it simpler, i have this event: Event source=abc time1=2023-11-10T00:33:53Z time2=2023-11-11T12:33:53Z How would you construct the query so that time2 is subtracted from time1 and display the time difference in the result using rex? Thanks!   ... View more

Never mind, my bad, i wasn't inside the Statistics tab. I now see the events matching the id. Thank you for all your help ... View more

Attached please find the modified query and part of the result screen shot ... View more

Attached please find the query screen shot.   ... View more

There is no relationship between id and duration. It's jut that since there can be multiple id, we need to only accept msg="consumed event" events where the id="XYZ". When i run the below query i get msg="consumed event" for every event, regardless what their id is. ... View more

One thing i forgot to mention is that event.data.id can be an array: event: {     data: {          [              {                    id: "XYZ"              }             {                    id: "123"              }          ]    } } ... View more

The query u provided does display the average duration, however for id="XYZ" doesn't seem to be check, because i get events for everything. ... View more

So here are two examples of events: Event #1 Event #1 { source: api event_id: abcde msg: "consumed event" type: abc event: { data: { id: 12345 } } } Event #2 { source: api event_id: abcde msg: "finished processing event" type: abc duration: 0.023456789 } first need to query for msg="consumed event" and msg="finished processing event" that have the same event_id. Also need to only accept the ones that for msg="consumed event", its event.data.id is specific for a value: Query #1 source=api AND msg="consumed event" | rename event.data{}.id AS id | where id=12345 Query #2 source=api AND msg="finished processing event" AND duration>0 | stats ave(duration) I need to joion these queries into one where their event_id field is the same and at the end calculate and display the average duration which is a field only in events where msg="finished processing event" ... View more

Sorry @bowesmana i just changed the Query #1 slightly: Query #1 source=abc type=Changed msg="consumed event" event_id="*" | rename event.data{}.id id | where id="XYZ" Query #2 source=abc type=Changed" msg=" finished processing"  duration>1 | stats avg(duration) I want to join the two above queries and at the end show the avg(duration). duration is a field from the second query. Thanks! ... View more

Thanks @bowesmana  for your help. So here are two queries: Query #1 source=abc type=Changed msg="consumed event" event_id="*" |  Query #2 source=abc type=Changed" msg=" finished processing"  duration>1 | stats avg(duration) I want to be able to do the above two searches in one. based on the event_id being the same and at the end displaying the average of the duration which is the field from the second query. Thanks! ... View more

Thank you! ... View more

You rock, thanks this works! ... View more

Great, that works! Thanks for the info. appreciate it! ... View more

Sorry forgot to ask the question. I need to modify this search : source=r42-core-api msg="served request" duration | stats count, avg(duration)  by path_template to only display the columns/numbers where avg(duration) > 1 second. How do i do that? Thanks! ... View more

Yes this works, thank u very much! ... View more