@sainag_splunk's solution should work. A less literal, but more traditional way to do this is | stats dc(ServerName) as count by UpgradeStatus
| eventstats sum(count) as total
| eval count = count ...
See more...
@sainag_splunk's solution should work. A less literal, but more traditional way to do this is | stats dc(ServerName) as count by UpgradeStatus
| eventstats sum(count) as total
| eval count = count . " (" . round(count / total * 100) . "%)"
| fields - total
| transpose header_field=UpgradeStatus
| fields - column Here is an emulation | makeresults format=csv data="ServerName, UpgradeStatus
Server1, Completed
Server2, Completed
Server3, Completed
Server4, Completed
Server5, Completed
Server6, Completed
Server7, Pending
Server8, Pending
Server9, Pending
Server10, Pending"
| stats dc(ServerName) as count by UpgradeStatus
| eventstats sum(count) as total
| eval count = count . " (" . round(count / total * 100) . "%)"
| fields - total
| transpose header_field=UpgradeStatus
| fields - column