How to get a count and percentage for denied connections in cisco web appliance

[lmyoung]

I am trying to get the number of denied connections from squid proxy logs from a Cisco Ironport web security appliance.

Using sc_result_code with values:
TCP_DENIED,
TCP_MISS,
TCP_CLIENT_REFRESH_MISS,
TCP_MEM_HIT,
TCP_REFRESH_HIT,
TCP_IMS_HIT,
TCP_HIT

I would like to get a table that shows the tcp_denied value as count and a count% and the other values combined with a count and a count %.

[Ayn]

... | eval sc_type = if(sc_result_code == "TCP_DENIED", "TCP_DENIED", "OTHER") | top sc_type