##1 (index=_internal sourcetype=scheduler status="completed" (host=sh*.*splunk*.* OR host=si*.*splunk*.*)) | eval window_time=if(isnotnull(window_time),window_time,0), execution_latency=max((dispatch_time - (scheduled_time + window_time)),0) | timechart eval(round(avg(execution_latency), 0)) as latency by app ##2 (group="searchscheduler" index=_internal sourcetype=splunkd (host=sh*.*splunk*.* OR host=si*.*splunk*.*)) | timechart minspan=30s sum(completed) as completed_count, Sum(total_runtime) as total_runtime | eval total_runtime=round(total_runtime,0)