| rex field=Uptime "(?<Uptime_Days>^([^d]+))"
| eval Uptime_Years=(Uptime_Days/365)
| dedup Host_Name
| eval Description=(case(Uptime_Years>=7, "Over 7 Years", Uptime_Years<7 AND Uptime_Years>3,"3 to 7 Years", Uptime_Years<3, "Less than 3 Years" ))
| rename Description as "Uptime_Category"
| stats count(Host_Name) as total by Uptime_Category
| eventstats sum(total) as grand_total
| eval percentage = round((total/grand_total)*100,1)
| table Uptime_Category percentage
| eval Description=(case(Uptime_Category="Over 7 Years" AND percentage>="10%","Poor",
Uptime_Category="3 to 7 Years" AND percentage>="20%","Needs Attention", Uptime_Category="Less than 3 Years" AND percentage>="80%","Good" ))
| rename Description as "Health Status"
| stats count by "Health Status"
Need help with Color Coding Poor to "Red", Needs Attention to "Yellow", & Good to "Green" @niketn
