Thanks, a lot... Its working  🙂 🙂  ... View more

what if ,it has more than 50k events index="aaam_devops_elasticsearch_idx" | search project = Einstein360_TicketsCreated_ElasticSearch_20210419 | search source.TransactionName ="ITGTicketCreated" | dedup id | timechart span=1d count as ITGTicketCreated | join max=0 _time [| search index="aaam_devops_elasticsearch_idx" | search project = Einstein360_TruckRollCreated_ElasticSearch_20210420 | search source.TransactionName = "Truck_Roll_Create_Result" | timechart span=1d dc(id) as TruckRollCreated] | stats values(ITGTicketCreated) as ITGTicketCreated values(TruckRollCreated) as TruckRollCreated by _time   ... View more