Like this: |makeresults | eval raw="Properties.CorrelationId=23F4991E-EB37-447A-6702-44B7834DA0E2,count=7,percentage=63.63,totalCount=33 Properties.CorrelationId=A8D81A89-2D6A-48AD-733B-CD0A802F62B8,count=7,percentage=63.63,totalCount=33 Properties.CorrelationId=D85CB087-6BE9-419E-670A-BD9770525A15,count=7,percentage=63.63,totalCount=33 Properties.CorrelationId=1200CC97-6615-4AF4-7586-DC00207AB1E8,count=6,percentage=36.36,totalCount=33 Properties.CorrelationId=18F8F6C7-752A-42DB-5880-ABE0BF8E5DE2,count=6,percentage=36.36,totalCount=33" | makemv raw | mvexpand raw | rename raw AS _raw | kv | table P* count per* tot* | rename COMMENT AS "Everything above generates sample events; everything below is your solution" | stats count AS "Total" BY count percentage totalCount | table count Total percentage totalCount | rename totalCount AS "Grand Total", count AS Count | sort 0 - percentage ... View more