I think I understand - try this search to create a table with fields: _time, percentage and one or more columns based on the value calculated each hour: | gentimes start=-7
| eval sample=random...
See more...
I think I understand - try this search to create a table with fields: _time, percentage and one or more columns based on the value calculated each hour: | gentimes start=-7
| eval sample=random()%100
| eval perc=random()%50
| rename starttime as _time
| append[|makeresults | eval sample=100, perc=45| table _time, sample, perc]
| timechart span=1d max(sample) as name, avg(perc) as "percentage"
``` Calculate how we name the fields based on the value of: name ```
| eval rename_field_to=if(name=100,"C","N/A")
| eval "The Sample Yields {rename_field_to}" = name
| fields - rename_field_to, name This will create three or four columns: _time = time percentage = hourly average of the perc field The Sample Yields C = If the max for that hour was 100 The Sample Yields N/A = If the max for that hour was not 100 If you only want "The Sample Yields C" or nothing, then you can filter out with a | search name="C" after the timechart command. The main SPL is : | eval "The Sample Yields {rename_field_to}" = name That will allow you to name a field using the value of another field. If you want NA to simply be N/A then you can do a rename: | rename "The Sample Yields N/A" as "N/A" Is that closer to what you were after?