try this
sourcetype="xxx" source="yyy.log"
| eval read_category = case (
duration < 3,"glanced",
duration > 8, "read",
duration >= 3 AND duration <= 8, "skimmed"
)
| lookup cml_campaign_lookup_2018_12_11.csv deliveryid OUTPUT Campaign, sent_date
| table deliveryid, user, duration, clientIP, read_category, Campaign, sent_date
| chart count as total over Campaign by read_category
| eval totcount=glanced + read + skimmed
| eval glancedperc = glanced/totcount*100
| eval readperc = read/totcount*100
| eval skimmedperc = skimmed/totcount*100
| fields - totcount
... View more