Hi, Previous example almost work but it took all fields from event to create charts (like field1 and field2 from example event) But after tuning it up it now works correctly. Many thanks for your help @bowesmana . Case closed. | timechart span=1m fixedrange=f perc90(execution_times.*) as *_p90 perc99(execution_times.*) as *_p99
| foreach *_p* [ eval services=mvappend("service_<<MATCHSEG1>>".":"."<<MATCHSEG2>>".":".'<<FIELD>>',services) ]
| fields _time services
| mvexpand services
| rex field=services "(?<service>[^:]*):(?<p>[^:]*):(?<v>.*)"
| eval p_{p}=v
| fields - p services
| stats values(p*) as p* by _time service
... View more