Hi guys, I need to evaluate a disruption.  It can last multiple hours, so I need to use data which is at least 4h old. This query needs to show all disruptions that are longer than 15 minutes with it's starting timestamp and it's last occurring timestamp. To group all logged events, I need a transaction which also contains the field CompleteDescription. If this field contains specific values which can be seen in the query, it is a disruption. The query I've build works so far but is to slow to collect data from multiple hours. Does anyone have an idea how to improve the query for more performance? Thank you!     index=log sourcetype=servlog | transaction ThreadId host maxspan=180s startswith=(LogMessage=start) endswith=(LogMessage=end) | stats earliest(_time) as "first", latest(_time) as "last", count by Type, CompleteDescription | eventstats sum(count) as count_full by Type, CompleteDescription | eventstats sum(count_full) as total by Type | eval percentage = round((count_full/total)*100,0) | eval time_diff = round((last - first)/60, 0) | eval CompleteDescription=upper(CompleteDescription) | search Type!=SSL (CompleteDescription = "MISSING RESPONSE" OR CompleteDescription = "TIMEOUT" OR CompleteDescription = "TECHNICAL ERROR" OR CompleteDescription = "INTERNAL SYSTEM ERROR" OR CompleteDescription = "NO REACHABILITY") total >= 10 percentage >= 50 time_diff >= 30 | convert ctime(first) ctime(last) | table Type, CompleteDescription, count_type, count, percentage | sort - percentage, total       ... View more

Hey guys. I have multiple events combined to transactions. I'd like to view the duration of each transaction on a timechart to have an overview about when and how long which transaction occured. My search so far is: searchterms | eval start_time = if(like(_raw, "%START%"), 'start', 'null') | eval end_time = if(like(_raw, "%END%"), 'end', 'null') | transaction JobDescription startswith=(LogMessage="* START *") endswith=(LogMessage="* END *") maxevents=5000 | timechart [pls help] I'm pretty lost on that case, so help is very appreciated 🙂 ... View more