Hi @Gauri you can use "|eventstats" instead of "|stats" to keep the data in the pipeline for the later "|stats" command:     | eval totalResponseTime=round(requestTimeinSec*1000) | convert num("requestTimeinSec") | rangemap field="totalResponseTime" "totalResponseTime"=0-3000 | rename range as RangetotalResponseTime | eval totalResponseTimeabv3sec=round(requestTimeinSec*1000) | rangemap field="totalResponseTimeabv3sec" "totalResponseTimeabv3sec"=3001-60000 | rename range as RangetotalResponseTimeabv3sec | eval Product=case( (like(proxyUri,"URI1") AND like(methodName,"POST")) OR (like(proxyUri,"URI2") AND like(methodName,"GET")) OR (like(proxyUri,"URI3") AND like(methodName,"GET")), "ABC") | bin span=5m _time | stats count(totalResponseTime) as TotalTrans by Product URI methodName _time | eventstats sum(eval(RangetotalResponseTime="totalResponseTime")) as TS<3S by Product URI methodName | eventstats sum(eval(RangetotalResponseTimeabv3sec="totalResponseTimeabv3sec")) as TS>3S by Product URI methodName | eval SLI=case(Product="ABC", round('TS<3S'/TotalTrans*100,4)) | rename methodName AS Method | where (Product="ABC") and (SLI<99) | stats sum(TS>3S) as AvgImpact count(URI) as DataOutage by Product URI Method | fields Product URI Method TotalTrans SLI AvgImpact DataOutage | sort Product URI Method     ... View more

Any Solution ? ... View more

Please give us a mock-up of what your desired output would look like ... View more