index=xxx (earliest=1579014000 latest=1579100400 ) OR (earliest=1579100400 latest=1579186800) AND sourcetype=extendedevent DatabaseName="DbName" AND (( "Finished processing the" OR EventClass=COMMAND_END ) OR "TextData=*SELECT") | eval ObjectName=if(isnull(ObjectName), "Full_Processing_time",ObjectName) | eval Date=strftime(_time,"%d/%m/%y") | eval Select_Query=if(searchmatch("TextData=*SELECT"),round(tonumber(Duration)/1000/60,2),NULL) | eval SSAS_Processing=if(NOT searchmatch("TextData=*SELECT"),round(tonumber(Duration)/1000/60,2),NULL) | chart limit=0 max(SSAS_Processing) AS SSAS_Processing, max(Select_Query) AS Select_Query BY ObjectName Date append is searching twice, so I don't use it. maybe, it works Reordering field names can be difficult. ... View more