@j_r from your requirement seems like you need percent of InProgress and Total over time so that Single Value has both percent and Sparkline for trend. This is different from stats which is overall Total and percent. Try the following: index = lc source= X | timechart count as Total count(eval(status="InProgress")) as InProgress | eval perc=round((InProgress/Total)*100,2) | fillnull value=0 | table _time perc Following is a run anywhere search based on Splunk's _internal index and splunkd_ui_access sourcetype which give Success % access over time on similar lines. index=_internal sourcetype=splunkd_ui_access | timechart count as Total count(eval(status=200)) as Success | eval perc=round((Success/Total)*100,2) | fillnull value=0 | table _time perc ... View more

It worked by adding values(another_field) 🙂 Thanks! ... View more

Hi @j_r Try it this way: | stats sum(duration) as sum_duration by RobotSubState | eval sum_duration_in_hhmmss=tostring(sum_duration,"duration") ... View more

@j_r, As per the comments, this should work with a single search. <form> <label>Destination</label> <fieldset submitButton="false"> <input type="dropdown" token="start"> <label>Start</label> <fieldForLabel>Destination</fieldForLabel> <fieldForValue>Destination</fieldForValue> <search> <query>|makeresults|eval Type="X,Y,X,Y",ID="1,1,2,2",Destination="A,B,C,D" |makemv Destination delim="," | makemv Type delim="," |makemv ID delim="," | eval x=mvzip(mvzip(Type,ID),Destination)|fields x| mvexpand x|eval x=split(x,",") |eval Type=mvindex(x,0),ID=mvindex(x,1),Destination=mvindex(x,2)|fields Type,ID,Destination|fields - _time |rename C as "Search above is data generation" |eventstats values(Destination) as TheOtherDest by ID | mvexpand TheOtherDest |where Destination!=TheOtherDest |dedup Destination</query> <earliest>-1s</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="dest"> <label>Destination</label> <search> <query>|makeresults|eval Type="X,Y,X,Y",ID="1,1,2,2",Destination="A,B,C,D" |makemv Destination delim="," | makemv Type delim="," |makemv ID delim="," | eval x=mvzip(mvzip(Type,ID),Destination)|fields x| mvexpand x|eval x=split(x,",") |eval Type=mvindex(x,0),ID=mvindex(x,1),Destination=mvindex(x,2)|fields Type,ID,Destination|fields - _time |rename C as "Search above is data generation" |eventstats values(Destination) as TheOtherDest by ID | mvexpand TheOtherDest |where Destination!=TheOtherDest |search Destination=$start$ |dedup TheOtherDest</query> <earliest>-1s</earliest> <latest>now</latest> </search> <fieldForLabel>TheOtherDest</fieldForLabel> <fieldForValue>TheOtherDest</fieldForValue> </input> </fieldset> <row> <panel> <title>Data</title> <table> <search> <query>|makeresults|eval Type="X,Y,X,Y",ID="1,1,2,2",Destination="A,B,A,B" |makemv Destination delim="," | makemv Type delim="," |makemv ID delim="," | eval x=mvzip(mvzip(Type,ID),Destination)|fields x| mvexpand x|eval x=split(x,",") |eval Type=mvindex(x,0),ID=mvindex(x,1),Destination=mvindex(x,2)|fields Type,ID,Destination|fields - _time |rename C as "Search above is data generation" |eventstats values(Destination) as TheOtherDest by ID | mvexpand TheOtherDest |where Destination!=TheOtherDest</query> <earliest>-1s</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form> ... View more

add |convert ctime(_time) at the end ... View more