@Ashwini_5 - Here is fully dynamic query that works with N number of course and status values: | eval combined=mvzip(course, status, "|") | mvexpand combined | eval course=mvindex(split(combined, "|"), 0), status=mvindex(split(combined, "|"), 1) | chart values(status) as status over ID by course   I hope this helps!!! ... View more

This will count number of IDs by the number completed | stats count by "No of Courses_completed" This will then show the segment with the count and percentage of each completed count A pie chart will already show you a percent, so if you want to remove the count and only have percent add this after the stats | eventstats sum(count) as Total | eval Percent=round(count/Total*100, 2) | table "No of Courses_completed" Percent However, the pie chart will still show the percent, which will be the same as the Percent field here ... View more

Try something like this |eval COMPLETED_CERT_COUNT=mvcount(mvfilter(match(TRAINING_STATUS,"Not_Expired"))) ... View more

@gcusello, Agreed but I'm not the OP, did not recommend join, maybe you've mistaken? My response is withinin the constraints and limited information that the OP provided.  My understanding was that:  report.csv contains a list of 5000 IDs for the purpose excluding a larger population on the main dataset (not enrichment). report.csv was saved as an inputcsv and wont work as a lookup unless it's moved/configured. used eventstats instead of stats in the event that the inscope ID contains multiple records since OP mention there are multiple certifications per ID. ... View more

Thanks for your reply. Issue resolved after adding below line in script.  from __future__ import print_function  ... View more

Thanks a lot for your kind reply 🙂 @ITWhisperer  It helped me  ... View more

The Dev manuals have some sample external commands.  See https://dev.splunk.com/enterprise/ ... View more

Hi @georgear7 ,  Have you found solution for this scenario? If so, Kindly share it.   ... View more