Hello hello! There may be a simpler way to get this working, but my first thought is to use something like this: Mysearch
| eval Guest=if(sid=22, "BOT", "Others")
| convert timeformat="%...
See more...
Hello hello! There may be a simpler way to get this working, but my first thought is to use something like this: Mysearch
| eval Guest=if(sid=22, "BOT", "Others")
| convert timeformat="%Y-%m-%d" ctime(_time) AS date
| stats count by date, Guest
| eventstats sum(count) as total by date
| eval percentage=round((count/total)*100, 0)
| eval count=count." (".percentage."%)"
| xyseries Guest date count Edit: Yep, here is a version that's a little shorter: Mysearch
| eval Guest=if(sid=22, "BOT", "Others")
| bin _time span=1d
| stats count by _time Guest
| eval
total=count,
percentage=round((count/total)*100, 0),
count=count." (".percentage."%)"
| xyseries Guest _time count