Hi, i am trying to create a pie chart with gives %age up and down time of a system. Splunk mines a log file with the below format giving the system availability stat. If you see below, we have three status System up, down and down due to db failure. we want to combine both the downs into single category of "Down" Were using the below query in splunk to get the pie chart but the Down comes up in two different segment. index=prd sourcetype="nodecheck" | rex "System (? .*)" | chart count by upordown 2014-03-17 15:53:00-SystemA System Up 2014-03-17 15:48:01-SystemA System Up 2014-03-17 15:43:00-SystemA System Up 2014-03-17 15:38:00-SystemA System Up 2014-03-17 15:33:00-SystemA System Up 2014-03-17 15:01:01-SystemA System Down 2014-03-17 15:31:00-SystemA System Down - Unable to connect to the Database! 2014-03-17 15:21:01-SystemA System Down - Unable to connect to the Database! 2014-03-17 15:11:01-SystemA System Down - Unable to connect to the Database! 2014-03-17 15:01:01-SystemA System Down - Unable to connect to the Database! 2014-03-17 14:48:00-SystemA System Up 2014-03-17 14:43:00-SystemA System Up ... View more