No need to feel stupid. There are an incredible number of options and commands in Splunk, so it's easy to not know about some of them! ... View more

I tried that but the value of the Logins must be passed if True. Then the Logins Column must be the Total number of Logins (including IE) So I had to make a small tweak: | savedsearch "Login Success (Raw)" | eval IELogins=if(ua_family="IE",Logins,0) | stats sum(Logins) as TotalLogins sum(IELogins) as IELogins by OBID District_Name STATE | eval percent=round((100*IELogins)/TotalLogins,0) | rename percent as "%" | table OBID, District_Name, STATE, IELogins, TotalLogins, % | search TotalLogins>100 IELogins>0 Only problem I have now is I don't want to see rows where IELogins=0 EDIT: I've figured that out. the code above has been changed to reflect this. ... View more