I need to get the count of the total number of events in the search and use it later to calculate the value of another field.  I am trying to use the eventstats command to do it.  When i use the eventstats to create a new total field and later to compute the errorPercentage , it is always null.  This is the sample query i am using:  <search> | eventstats count as total | eval Message_new = 'Message.msg' | rex mode=sed field=Message_new "s/^\"//g" | eval new_msg=case(like(Message_new,"%xyz%"),"abc",like(Message_new,"%qqq%"),"aaaa",1==1,"unknown") | eventstats max(_time) as maxtime, min(_time) as mintime | eval midpoint=(maxtime + mintime) / 2 | eval Period=if(_time > midpoint,"interval_2","interval_1") | eventstats count(new_msg) as errorcount by Period,new_msg | xyseries new_msg Period errorcount | eval percentSpike = round((( interval_2 - interval_1 ) / interval_1 ) * 100) | eval errorPercent = round(((interval_2 + interval_1) /total) * 100) | table new_msg interval_1 interval_2 percentSpike errorPercent ... View more