index=main sourcetype=_json status="True" | stats count(status) as True by name | append [| search index=main sourcetype=json status="False" | stats count(status) as False by name] | append [| search index=main sourcetype=json status="*" | stats count(status) as Total by name] | stats sum(True) as True sum(False) as False sum(Total) as Total max(Performance) as Performance by name | eval Percentage=round(((True/Total)*100),0)
| fields Percentage
Is it possible to show trendline and if Percentage up or down compart to last month.
@abi2023 - You would use timechart instead of stats with span=1mon.
But you are using by name, groupby field won't work with a single value chart. You could though a table with trendlines if you want to use groupby. You can find example of this inside the App called Splunk Dashboard Examples on Splunkbase.
I hope this helps!!!