Did you even try my solution? Here is a runanywhere example showing it working with dummy data | makeresults count=100
| fields - _time
| eval department="Department ".mvindex(split("ABCDE",""),ran...
See more...
Did you even try my solution? Here is a runanywhere example showing it working with dummy data | makeresults count=100
| fields - _time
| eval department="Department ".mvindex(split("ABCDE",""),random()%5)
| eval version=round(random()%3,1)
| eval thumb_print=random()%10
``` The lines above create some dummy data and can be replaced by your index search ```
| dedup version thumb_print department
| eval version=if(version="2.0","NEW_RUNS","OLD_RUNS")
| chart count(thumb_print) by department version
| fillnull value=0
| eval total=NEW_RUNS+OLD_RUNS
| eval perc=round(100*NEW_RUNS/total,2)
| eval department=substr(department, 1, 50)
| table department OLD_RUNS NEW_RUNS perc
| sort -perc