Hi, Task: 2 different log files (source types). I want to find all transactions from first payload and check which of them are missed in second one. Then calculate amount and percentage of transaction that are exist in both log files There is a common field in both log files, lest say fieldA The solution I came up so far looks like below one index=someIndex sourcetype=sourcetype1 SomeSearchCriteria | join fieldA type=outer [search index=fsomeIndex sourcetype=sourcetype2 SomeSearchCriteria] | fillnull value="NOVALUE" fieldA | eval ResponseStatus=case(fieldA ="NOVALUE","noResponse", fieldA!="NOVALUE", "validResponse") | bucket span=15m _time | stats count as Total count(fieldA) as NumberOfTransactions by ResponseStatus, _time | eventstats sum(Total) as TOTAL_TRANSACTIONS | eval PersentOfSuccessTransactions = round(100*NumberOfTransactions / TOTAL_TRANSACTIONS,2) | table PersentOfSuccessTransactions NumberOfTransactions ResponseStatus _time But in the response I see only "validResponse". Is this something wrong with the query? ... View more