found following working    | stats count as Count by attempts | eventstats sum(Count) as Total | eval perc=round((Count/Total)*100,2) | fields - Total | sort 0 - Count | head 10 ... View more

How can we show Percentage (%) of each attempt in table itself in stead of drawing different chart from same table ? ... View more

How to minus one attempt from final table as it counts 1 extra attempt in every event ... View more

Sample Data :  "objectA":{ "aggrStatus":"SUCCESS", "attempts":[ { "aggrStatus":"SUCCESS", "responses":[ { "requestTime":1626330378365, "responseTime":1626330378622, "status":"SUCCESS" } ] } ] }   "objectB":{ "aggrStatus":"FAILURE", "attempts":[ { "aggrStatus":"FAILURE", "responses":[ { "requestTime":1626329472707, "responseTime":1626329474713, "status":"FAILURE" } ] } ] } "objectC":{ "aggrStatus":"SUCCESS", "attempts":[ { "aggrStatus":"FAILURE", "responses":[ { "requestTime":1626329472707, "responseTime":1626329474713, "status":"FAILURE" } ] }, { "aggrStatus":"SUCCESS", "responses":[ { "requestTime":1626330378365, "responseTime":1626330378622, "status":"SUCCESS" } ] } ] }   "objectD":{ "aggrStatus":"SUCCESS", "attempts":[ { "aggrStatus":"FAILURE", "responses":[ { "requestTime":1626329472707, "responseTime":1626329474713, "status":"FAILURE" } ] }, { "aggrStatus":"FAILURE", "responses":[ { "requestTime":1626329472707, "responseTime":1626329474713, "status":"FAILURE" } ] }, ] } Let's assume Object A to D are results of search. and in my case, Only Object A and C should be considered for calculation as they are success and object B and D are failure.  ... View more