index=$index$ sourcetype=$sourcetype$ $string1$
.
.
| fillnull value=FALSE
| stats
count(email) AS TOTAL
count(eval(authenticated="TRUE")) AS auth_count
count(eval(cancelled="TRUE")) AS cancelled_count
count(eval(promoted="TRUE")) AS PROVISIONED
| eval AUTH_DROP_OUT=TOTAL-auth_count
| eval USER_CANCELLED=auth_count-cancelled_count
| eval LOGIN_DROP_OUT=TOTAL-AUTH_DROP_OUT-USER_CANCELLED-PROVISIONED
| table TOTAL,AUTH_DROP_OUT,LOGIN_DROP_OUT,USER_CANCELLED,PROVISIONED
| transpose
| rename column AS ActionTaken "row "1 AS Count
| eval ActionTaken=ActionTaken." : ".Count
@hmbisht
For total in Pie Chart Label, can you please try this?
<dashboard>
<label>Test Dashboard</label>
<search base="mysearch">
<query>stats sum(count) as total</query>
<done>
<set token="total">$result.total$</set>
</done>
</search>
<row>
<panel>
<title>My Pie Chart $total$</title>
<table>
<search id="mysearch">
<query>index="_internal"
| stats count by log_level</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</dashboard>