Hi, Previous example almost work but it took all fields from event to create charts (like field1 and field2 from example event) But after tuning it up it now works correctly. Many thanks for your help @bowesmana . Case closed.   | timechart span=1m fixedrange=f perc90(execution_times.*) as *_p90 perc99(execution_times.*) as *_p99 | foreach *_p* [ eval services=mvappend("service_<<MATCHSEG1>>".":"."<<MATCHSEG2>>".":".'<<FIELD>>',services) ] | fields _time services | mvexpand services | rex field=services "(?<service>[^:]*):(?<p>[^:]*):(?<v>.*)" | eval p_{p}=v | fields - p services | stats values(p*) as p* by _time service     ... View more

Thank you, that almost worked. I will be using a Trellis layout to show a chart for each "service" How can I tune this query to see p90 and p99 in a single chart? The chart for service_1 should display p90 and p99 lines only for service_1. Currently, in trellis, I am getting N*2 charts and I'd like to see just N. Probably I need to set some split by but don't know how. ... View more