Even though this thread is old, it's perhaps worth noting the ability to use TERM and PREFIX with tstats, which I believe was introduced in Splunk 8 at the end of 2019, which would not have been possible when this question was written. https://conf.splunk.com/files/2020/slides/PLA1089C.pdf   ... View more

| makeresults | eval field2count = split("n,y,n,n,y,n,n,y,n,n,n,y",",") | mvexpand field2count | stats count(eval(field2count="n")) as n count(eval(field2count="y")) as y count(field2count) as total | eval n = round(n/total,3) *100, y = round(y/total,3) *100 | fields - total | transpose | rename column as field2count, "row 1" as total ... View more

This looks really nice! How would I populate "ip_list" with output from my own "base search"? Or do some direct pipe to eval? ... View more

| makeresults | eval src_host = split("8.8.8.8,dns.name,server_name, 172.217.9.206",",") | mvexpand src_host | foreach src_host [ eval tempip = if(match(src_host,"(\d{1,3}\.){3}\d{1,3}"), src_host, "") | lookup dnslookup clientip as tempip ] | eval src_host=if(match(clienthost,"\w"),clienthost,src_host) ... View more