How to Count string matches in event record and calculate percentage?

[C37996518]

I have a log that documents call results for phone calls as a CSV event record
There is a field in the event record for the phone number
The event record may contain a list of sub-events that I want to track.
If the CSV event record contains a sting "MOCK,?,?,1" that is counted as a BAD call. The "1" is what determine it's a bad call we don't care what the ? number are)
If the event record has any event ("MOCK,?,?,0" but not "MOCK,?,?,1") this is a Good call

A would like to report to show the number of calls to  every  "phone number" and the percentage of Bad calls

[ITWhisperer]

Assuming you have already extracted your fields and field1 ("MOCK") is the number and field4 ("0" or "1"), then you can try this

| stats count count(eval(field4=="1")) as bad by field1
| eval percent=100*bad/count

[C37996518]

Thanks but I have not extacted the (Mock?,?,x) as a field. This issue is the MOCK string can occur zero or many times in a call.

[ITWhisperer]

As you can see, without an accurate picture of the events you have and what fields you already have extract, I can only guess at possible solutions.

What is it you want help with? Is it the extraction of data into fields, or the type of search you need to count and work out percentages, or, how to filter out the events you don't need to count, or how to correlate events by "number"?

Perhaps if you could share some de-sensitised events and what you have already tried, we might be able to help you progress?