I was able to successfully get this working with the guidance, thanks. ... View more

Thanks, let me give that a go in the overall solution, but it looks very promising. ... View more

👏Yes, this is the way. Thanks @ITWhisperer  this is exactly what I was looking for. ... View more

Yes and I don't think that's what I want.  That seems to sum the split values, I want the non-split (effectively average) value.  If there were a similar avgtotals that would probably be what I'm looking for. ... View more

The goal is to calculate an overhead value over a span of 1 second. Overhead is calcuated as being the difference between totaltime and routingtime.  Then for each host as identified by hostname, create a line chart that shows the overhead for each host, and include another line on the chart that shows the average overhead across all hosts. Here are a few anonymized sample records: {"severity":"Audit","hostname":"ahost02","received":"2025-01-14T19:12:44.623Z","protocol":"http","routingtime":189,"totaltime":234} {"severity":"Audit","hostname":"ahost01","received":"2025-01-14T19:12:44.650Z","protocol":"https","routingtime":27,"totaltime":78} {"severity":"Audit","hostname":"ahost01","received":"2025-01-14T19:12:44.634Z","protocol":"http","routingtime":36,"totaltime":74} {"severity":"Audit","hostname":"ahost02","received":"2025-01-14T19:12:44.427Z","protocol":"http","routingtime":205,"totaltime":220} ... View more

That's the ticket. I have a little more tweaking to do, but this appears to be the hint I needed. Thanks @ITWhisperer . ... View more

That sort of worked, though the behavior seems odd.  It still seems to take several seconds to populate the second table, I would have thought it would have been almost instant since it is only filtering an already returned data set, which only has 10 records.  Here is the base search and the chain search if it helps: Base search (there are several input fields on the dashaboard that are used to populate the search parameters): index=index_name "Header.EntryType"=$entryType|s$ sourcetype=$environment|s$ "Header.ApplicationName"=$appName|s$ "Header.SubmittingUser"=$userId|s$ | fields "Header.ApplicationName", "Header.EntryType", "Header.SubmittingUser", "Header.LoggingProcess.MachineName", "Header.LoggingProcess.AppDomain", "Header.LoggingProcess.Assembly", "Header.LoggingProcess.ClassName", "Header.LoggingProcess.Method", "Header.Message", "Header.EntryTimestamp", "Items", "Items{}.Key", "Items{}.Value", "Data" Chain search (the selected* tokens created when a row is clicked in the first table from row.[Column Name].value): | where 'Header.EntryType'=$selectedEntryType|s$ AND 'Header.EntryTimestamp'=$selectedTimestamp|s$ AND 'Header.SubmittingUser'=$selectedSubmittingUser|s$ AND 'Header.ApplicationName'=$selectedApplicationName|s$ AND 'Header.LoggingProcess.MachineName'=$selectedMachineName|s$ | rename "Items{}.Key" AS "Keys", "Items{}.Value" AS "Values" | foreach Values[replace "" with "NULL"] | table "Keys", "Values" The other odd behavior besides it still taking a few seconds to load is that if the job that populated the base search has expired, then when the chained search is executed by selecting a different row in the first table, it runs the base search again.  Maybe that's by design, but with two separate searches that are not chained, this behavior is not observed since the second search can run based solely on input from tokens populated in the drill down.  Which means the data in the first table doesn't refresh just because the second search is run again. It seems, if it were possible, simply pulling the Items data out of a hidden column in the first table would be ideal, but that doesn't seem to be possible (yet?). ... View more

I had thought of that as well, but the docs on base searches indicate that the base search should be a transforming search. Mine is not (yet?). I may need to generate a random unique value to inject into the base search to make each row unique (I thought they were but it turns out they are not) so I can use something like stats. Let me play with that and see what I can work out. I'll let you know how it goes. ... View more