The horizontal display of fields is governed by an alpha-numeric ordering. I would expect to see Tid, StepA1, StepA2 ... StepA11, StepB1 ... StepB9, StepStart StepEnd If you reassign the field value prior to the xyseries piece, then you can get it done. Like this: | eval Step=if(isnotnull(StepA),StepA.ida,if(isnotnull(StepB),StepB.idb,Step)) | eval Step=if(Step=="stepEnd","StepStart/StepEnd",Step) | xyseries Tid Step duration ... View more

Great to hear! ... View more

Thanks so much for your help. I'm getting 'Error in 'streamstats' command: The argument ' ' is invalid. Is it because I tried to sum up two different event pairs? TimeStamp1 Step=stepStart, Tid=1111 TimeStamp2 Step=stepA, Tid=1111 TimeStamp3 Step=stepB, Tid=1111 TimeStamp4 Step=stepC, Tid=1111 TimeStamp5 Step=stepD, Tid=1111 TimeStamp6 Step=stepA, Tid=1111 TimeStamp7 Step=stepB, Tid=1111 TimeStamp9 Step=stepA, Tid=1111 TimeStamp10 Step=stepB, Tid=1111 TimeStamp11 Step=stepC, Tid=1111 TimeStamp12 Step=stepD, Tid=1111 TimeStamp13 Step=stepEnd, Tid=1111 | eval TotalTime = duration | sort 0 TimeStamp | streamstats current=f window=1 first(TimeStamp) as prev | eval stepABDuration=if(Step="stepB", Timestamp-prev,0) | eval stepCDDuration=if(Step="stepD", TimeStamp-prev,0) | stats sum(stepABDuration) as stepABDuration by Tid | stats sum(stepCDDuration) as stepCDDuration by Tid | transaction TId | table Tid, TotalTime, stepABDuration, stepCDDuration ... View more