Is there a way to divide the addcoltotals from each case statement in the following :
eval daysclass=case(
NoOfDays<=14,"0-14 DAYS ",
NoOfDays>15 AND NoOfDays<=28,"14-28 DAYS ",
NoOfDays>29 AND NoOfDays<=42,"28-42 DAYS ",
NoOfDays>43 AND NoOfDays<=56,"42-56 DAYS",
NoOfDays>57, "56 DAYS OR MORE "
,1=1,"NULL")|search daysclass!=NULL|stats count(Name) AS "COUNT" by daysclass| ADDCOLTOTALS
if i get what you're doing, i think this might work:
eval daysclass=case(
NoOfDays<=14,"0-14 DAYS ",
NoOfDays>15 AND NoOfDays<=28,"14-28 DAYS ",
NoOfDays>29 AND NoOfDays<=42,"28-42 DAYS ",
NoOfDays>43 AND NoOfDays<=56,"42-56 DAYS",
NoOfDays>57, "56 DAYS OR MORE "
,1=1,"NULL")|search daysclass!=NULL|stats count(Name) AS "COUNT" by daysclass|eventstats sum(COUNT) as total|eval divide=COUNT/total