Hi, can anybody help me please? I have _json indexed events in Splunk. 19.08.21 08:26:27,746 { [-] name: S8.ManuelFail value: false } 19.08.21 08:26:25,746 { [-] name: S8.Pruefprogramm_PG value: S3_450 } 19.08.21 08:26:27,746 { [-] name: S8.ManuelFail value: true } 19.08.21 08:27:25,746 { [-] name: S8.Pruefprogramm_PG value: S3_450 } 19.08.21 08:28:25,746 { [-] name: S8.Pruefprogramm_PG value: S3_600 } 19.08.21 08:29:25,746 { [-] name: S8.Pruefprogramm_PG value: S3_600 } In the dashboard I choose specific time interval with the time pick up element. E.g. last 24 hours. I would like to have % number for each name: S8.Pruefprogramm_PG and its value, where name: S8.ManuelFail has value: true. It means % all name: S8.ManuelFail value: true against all name: S8.ManuelFail value: true/false. It is even possible? E.g. in this case I would like to have a table output: S8.Pruefprogramm_PG S8.ManuelFail [%] S3_450 50
... View more