Give this a try my base search | transaction ID | stats count values(Date) as Date value(field1) as field1 by ID | where isnull(mvfind(Date,"02\/20\/23")) ... View more

Give this a try index="va_tools_oit-salesforce" source="sfdc_event_log://EventLog_va_my_salesforce_com_eventlog_va" sourcetype="sfdc:logfile" URL=""https://case.mibams.ba.com/api/ms* | rex field=_raw "\"\"https:\/\/case.mibams.ba.com\/api\/(?<API>[^\/]+\/[^\?\/]+)" | stats count by API | table API ... View more

Give this a try. Everything before "| table user region score rank" is search to generate sample data, replace it with your actual search. On the 2nd the to the last row, the number that is multiplied to field 'perc' ("10*perc") is the number of top results you want to display change it to 100 as per your requirement. | makeresults | eval raw="user1 NA 99 1# user2 NA 98 2# user3 NA 97 3# user4 NA 96 4# user5 SA 95 5# user6 EU 94 6# user7 NA 93 7# user8 NA 92 8# user9 NA 91 9# user10 NA 90 10# user11 SA 89 11# user12 SA 88 12# user13 NA 87 13# user14 NA 86 14# user15 NA 85 15# user16 NA 84 16# user17 EU 83 17# user18 EU 82 18# user19 EU 81 19# user20 NA 80 20"| makemv raw delim="#" | mvexpand raw | rex field=raw "(?<user>\S+)\s+(?<region>\S+)\s+(?<score>\S+)\s+(?<rank>\d+)" | table user region score rank | sort region rank | streamstats count as sno by region | appendpipe [| stats count by region | eventstats sum(count) as total | eval perc=round(count*100/total) | table region perc total] | eventstats values(perc) as perc values(total) as total by region | where isnotnull(user) | eval threshold_sno=round(10*perc/100) | where sno<=threshold_sno   ... View more

Give this a try |inputlookup append=t test1_checks.csv | append [| makeresults | eval Alert_type="test2", Correlated_alert="test2", Correlation_type=0 | table Alert_type Correlated_alert Correlation_type ] | stats last(Correlation_type) as Correlation_type by Alert_type Correlated_alert | outputlookup append=true test1_checks.csv ... View more