I'm not sure that works. In my case it doesn't show anything and I'm using the same as you. index=blueprism sourcetype=BP_Parkour_Status source=TABLA::RPA_BLUEPRISM
| bin span=1d _time
| stats count as total by _time
| where tipoexcep="Business Exception"
| stats count as totalDetalle by detalexcep _time
| eval porc=totalDetalle/total*100
| table totalDetalle total porc
... View more