https://community.splunk.com/t5/Splunk-Enterprise-Security/Percent-problems/m-p/444223#M6010 <P>You could do something like the below, as you are interested in Open/Closed only</P> <PRE><CODE>| eval percent= round ( if(actioned="true",count*100/total,0),1) | search percent &gt; 0 | gauge percent 0 40 60 100 | fillnull value=0 </CODE></PRE> Tue, 19 Mar 2019 11:23:50 GMT lakshman239 2019-03-19T11:23:50Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Percent-problems/m-p/444222#M6009 <P>Hi, </P> <P>Struggling to get the percentage to work properly...</P> <P>I have 3 fields; Open, Closed and New.</P> <P>I want to report on the percentage of events which have a status of either Closed or Open.</P> <P>Trying to play with the following but cant get it working;</P> <P>| eval actioned=if(in(status_group,"Open", "Closed"),"true","false") <BR /> | stats count by actioned<BR /> | eventstats sum(count) as total <BR /> | eval percent= round ( count*100/total,1) <BR /> | gauge percent 0 40 60 100 <BR /> | fillnull value=0</P> <P>Any ideas? Thanks.</P> Tue, 19 Mar 2019 10:26:46 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Percent-problems/m-p/444222#M6009 jacqu3sy 2019-03-19T10:26:46Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Percent-problems/m-p/444223#M6010 <P>You could do something like the below, as you are interested in Open/Closed only</P> <PRE><CODE>| eval percent= round ( if(actioned="true",count*100/total,0),1) | search percent &gt; 0 | gauge percent 0 40 60 100 | fillnull value=0 </CODE></PRE> Tue, 19 Mar 2019 11:23:50 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Percent-problems/m-p/444223#M6010 lakshman239 2019-03-19T11:23:50Z