ah, I think I lose num_users after the second stats. So maybe this would work too? Or just eventstats both of them? ... | eventstats dc(userID) num_users | where is_successful=false | stats dc(userID) as num_failed_users max(num_users) as num_users by version | eval percent_failed_users = num_failed_users/num_users ... View more