Thanks for both response! Meanwhile i was working different method like below, I got percentage results, wanted to confirm if this is correct way of doing it? or anything wrong in it. ( (index=compliance sourcetype=site1-ip ) OR (index=automation sourcetype=site2-asset)) | eval ip=case(sourcetype="site1-ip", 'src.ip', sourcetype="site2-asset", ip ) | eval te=if(sourcetype="site2-asset","yes","no") | eval ta=if(sourcetype="site1-ip","yes","no") | stats max(eval(if(te="yes",1,0))) AS SCANNED max(eval(if(ta="yes",1,0))) AS CTA values(fqdn) as fqdn_ta values(resourceOwner) as ip.owner by ip | search (CTA=1) | stats count(eval( SCANNED > 0)) AS tes, count(ip) as total | eval percent = round((tes/(total))*100,2) Thanks again!
... View more