@georgear7 First of all, Need an _time field to plot a line chart. It should be time series data. In this case, 1) assign a new _time like this. Do it before override fields by strftime. | eval _time=StartTime Note: Basically if you search without tstats and _indextime, you don't need to care attempt _time with search. _time included with events. 2) Using timechart command + avg() aggregation function is the simple way to plot line chart. Of course you can do same thing with stats command but don't forget _time. Modify the span=1d to change aggregation time span. If you don't need GROUP BY, please remove BY clauses. | timechart span=1d avg(TimeTaken) by FileName Here is a sample. | tstats min(_indextime) as StartTime max(_indextime) as EndTime where index=* source=*.restart.log by source
| rename source as FileName
| eval _time=StartTime
| eval TimeTaken= round((EndTime - StartTime)/60,2)
| eval StartTime=strftime(StartTime, "%d/%m/%Y %H:%M:%S"),EndTime=strftime(EndTime, "%d/%m/%Y %H:%M:%S")
| timechart span=1d avg(TimeTaken) by FileName
... View more