Please can you provide some sample events to demonstrate your issue? ... View more

😅😅😅😅you're right... It works perfectly... Thank you so much, @PickleRick ! ... View more

Hi @pedropiin  Where do the values currently come from that you want to use within your eval? ... View more

A typical way to do this is via a background search that uses the actual time token to run the search and then set tokens based on addinfo output which gives you info_min and max times, e.g. <search> <query> | makeresults | addinfo </query> <earliest>$schedule_dttm.earliest$</earliest> <latest>$schedule_dttm.latest$</latest> <done> <set token="schedule_dttm_epoch_earliest">$result.info_min_time$</set> <set token="schedule_dttm_epoch_latest">$result.info_max_time$</set> </done> </search> then you just use the new tokens in searches. You can also do a similar thing with a subsearch by using addinfo to get the actual converted time and returning earliest and latest fields from the subsearch, but that's not the same as saving the epoch values. ... View more

Your sample test data shows a field called "tickets" when your stats command is using a field called "ticket" - is it simply a typo in your example, or in your actual search? ... View more

Hi @pedropiin , the stats command automatically dedups values, so you don't need to use the dedup command before the stats command. Ciao. Giuseppe ... View more

hi @pedropiin  Does this work? | eval time_var=strptime(json_extract(_raw,"payload.eventProcessedAt"), "%Y-%m-%dT%H:%M:%S") Please let me know how you get on and consider adding karma to this or any other answer if it has helped. Regards Will ... View more

Thank you for your response! It definitely works, but it has two issues, both related to each other: 1) It gives two row, instead of adding columns. Running the query for only one app, gives me one row per date, in which the metrics are the columns. Using your strategy gives me two rows per date, one for each app. Is it possible to set the metrics side-by-side as different columns? Having two rows is a problem as, in theory, the user should be able to compare both applications for a range of, let's say, 1 month. So having two rows per day and making the user compare between pairs of rows while in the middle of other 58 makes it confusing. 2) Related to the last topic, how would I rename them? Because as this strategy gives me two rows, the distinction between the apps is based on identifying which row corresponds to each app. Would it be possible to rename the metrics in such way that I have "Average App 1" and "Average App 2"? ... View more

Hi @livehybrid  It worked perfectly!  Thank you so much ... View more

If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

Ok. If your initial stats doesn't include _time field, there's nothing to bin. That's why you're getting no results. ... View more