appendpipe did it for me. I have two combined subsearches (different timeframes) so i had to calculate the percentage for the two totals manually: index=xxx "search pattern" dvc=xxx earliest="05/07/2018:00:00:00" latest="05/08/2018:00:00:00" | multikv | timechart span=30m count as today | appendcols [ search index=xxx "search pattern" dvc=xxx earliest="04/30/2018:00:00:00" latest="05/01/2018:00:00:00" | multikv | timechart span=30m count as yesterday ] | eval percentage = round((today / yesterday - 1) * 100, 2) | rename yesterday as "Value1", today as "Value2", percentage as "Percent", _time as "time" | convert ctime("time") | table "time", "Value1", "Value2", "Percent" | appendpipe [ eventstats sum("Value2") as total_today, sum("Value1") as total_yesterday | eval perc_sum = round((total_today / total_yesterday -1) * 100, 2) | stats sum("Value1") as "Value1", sum("Value2") as "Value2", values(perc_sum) as "Percent"] | fillnull value="total" Thank you very much! ... View more