do you want results for each row, each column or all together? Here is an example using foreach that should get you the total percent across the entire lookup. | inputlookup input.csv | foreach * [ eval count = coalesce(count+1,1), zero_count = if(<<FIELD>> = 0,coalesce(zero_count+1,1),zero_count)] | stats sum(count) as total, sum(zero_count) as zero_total | eval perc_zero = round(100*(zero_total/total),2) For each is processed for every row like other commands, but it then iterates through each field in a row based on the filter. In this case, all fields (*). The new count field i created just counts the number of fields. Then the new zero_count field counts the number of fields that equal 0 - the <> notation references the name of the field we are are on while iterating through them all. After that, i'm just sum'ing those up and doing the percentage math. But you could instead just do the math at each row, or sum by the fields you're interested in, etc. ... View more

I think you can do this one search, using a subsearch or 2. Maybe like this: | tstats count as bigNumbers where index=blah [ | tstats count where index=blah sourcetype=mySpecialCase [ | makeresults | eval earliest=strftime(relative_time(now,"-24h"),"%m/%d/%Y:%H:%M:%S") | return earliest ] by source | rex field=source "."_special_(?<date>[\\d]+)" | eventstats max(date) as current | return source ] by UUID The outer search is the one that you want to run. Since your index seems to be static, i hard-coded it there. But it uses a subsearch to add the source condition to the where clause. The next search is the one that finds the source that you want. But since you want it to run over the past 24 hours (instead of whatever the timepicker would be), there's another subsearch. That one just does a "fake" search so that we can pass back an earliest field set to 24 hours ago, which is then added to your where clause right after the sourcetype condition. And since this is just a subsearch now, we don't have to build that whole search. Instead, we just want to return the source field. So that source will be added the outer search which will finally run and hopefully provide the results you want. Obviously, I can't test with your data, but it's probably close to what you'd...or hopefully at least gives you some more ideas. ... View more