How are you populating the summary index? If you're using "... | sitop http_domain" then the "... | top" is really the only valid thing you can do. On the other hand, if you store the summary manually, say "... | stats count by http_domain", then you should be able to compute "... | timechart sum(count) by http_domain". Calculating "... | top 50 http_domain" is a bit harder, say "... | stats sum(count) as count by http_domain | sort - count | head 50" and is even harder if you want percents, where you'll have to add "... | eventstats sum(count) as sum_count | eval percent = count / sum_count | fields - sum_count | ..." between the stats and the sort. ... View more

If you said that, I can't draw chart(or graph). ... View more

ah, thanks! I was mentally stuck on accum, which is clearly the wrong tool here. ... View more

If your events would contain " q=15ms "you could extract the numerical value using the rex command: <your search> | rex field=q "(?<q_numeric>\d+)(?<q_unit>\D+)" The field q_numeric would then contain the numeric value 15 and q_unit with the value "ms" You could also normalize the value of q_numeric like this: ... | eval q_us=if(q_unit="ms", q_numeric*1000, q_numeric) and filter out those events > 200ms with ... | where q_us>200000 ... View more