I got a visualization that counts the total amount of errors using a lookup. Instead of the actual number of events I'd like to get a percentage of specifically errors. Image attached for reference
| inputlookup fm4143_3d.csv
| stats count(ERROR_MESSAGE)
```| appendpipe
[| stats count as message
| eval message=if(message==0,"", " ")]
| fields - message ```
It is not clear what your events look like but assuming each event has an ERROR_MESSAGE field and you want to count by that message and work out the percentage of the total this represents, you could do something like this
| stats count by ERROR_MESSAGE
| eventstats sum(count) as total
| eval count=100*count/total