Try this sourcetype=iis_logs UserAgent=awesomemobileapp* | rex field=UserAgent "(?<os>iPhone|Android)" | stats count as total count(eval(os="Android" AND http_status<400)) as AndroidSuccess count(eval(os="iPhone" AND http_status<400)) as iOSSuccess| eval perc_Android=AndroidSuccess /total*100 | eval perc_iOS=iOSSuccess/total*100 | fields perc *OR* sourcetype=iis_logs UserAgent=awesomemobileapp* | rex field=UserAgent "(?<os>iPhone|Android)" | stats count(eval(http_status<400)) as Success BY os | addtotals | eval perc_Android=Android/Total*100 | eval perc_iOS=iPhone/Total*100 | fields perc ... View more

🙂 The error is in the second eval statement. I have corrected it now. ... View more

This worked! Thank you so much for your collaboration. Much appreciated. ... View more