Hello everyone.
Want to display the output only for the time which crosses 18 months (earliest time)
Hi @rajhemant26
Click 101010
and paste your query. Some part is truncating
Because _time is a special field, you will need to do this:
index=app sourcetype=mq_metric host=prod* QUEUE=DEAD.LETTER.Q OR MESSAGE.ACTION.Q
|stats p90(CURDEPTH) AS "Queue Depth" p90(MSGAGE) as "Massage Age" by QUEUE, _time | stats max(*) AS * max(_time) as _time |table _time,QUEUE,"Massage Age","Queue Depth"