If I use such SPL
index=_internal
| timechart span=1h count by host
| stats max(*) AS *."max", min(*) as *."min" | transpose
this produce min and max mixed in one column but I would like separate max and min column
↧