Hi all gurus, I have this following search, index=fbqr_index ACCOUNT STATUS: | rex "CLIENTID:(?<clientid>\w.*), UID:\[(?<uid>.*)\], ACCOUNT STATUS:(?<accountstatus>\w.*)" | makemv delim="," uid | streamstats latest(accountstatus) as lastAcctSts latest(_time) as lastEventTime by uid reset_after="("accountstatus=\"PENDING\"")" reset_before="("accountstatus=\"APPROVED\"")" | transaction lastEventTime | stats count(uid) as "Merchants" by lastAcctSts | append [ search index=fbqr_index \[cuid:*\] | stats distinct_count(cuid) as Merchants | eval lastAcctSts = "TOTAL" ] What i will like to ask is how do take the total that is append to join with every row other than the one append and calculate a percent based on the total. I am not so familiar with the splunk commands so bear with me for a while and Thanks in advance. ... View more