1. index=abc source="/opt/src/datasource.tmp" | dedup _raw | table Servers | stats count(Servers) as Total 2. index=abc source="/opt/src/datasource.tmp" | dedup _raw | table CompletedServers | stats count(CompletedServers) as Completed As @PickleRick points out, these searches you posted reveal potentially deeper problems that is your data. If there is a need to dedup _raw, you should try clean up data first. Also, there should never be two separate index searches using the same source. PickleRick already illustrated a single search to get the same counts. Let me further point out that most likely, the two searches produce the exact same count if Servers and CompletedServers appear in the same events. But back to your original table ServerName UpgradeStatus ========== ============= Server1 Completed Server2 Completed Server3 Completed Server4 Completed Server5 Completed Server6 Completed Server7 Pending Server8 Pending Server9 Pending Server10 Pending Obviously, neither of your searches will provide those "Pending" ones. When asking a question in a public forum, it is really important to explain your input and output. It is obvious that you did not think @sainag_splunk's and my previous answers did not give you the solution because you didn't even have the table. Because If you did, either of our searches will have given you the table you needed. So, I venture to guess that the real question is how to derive the first table from the index data you have. Once this table is formed, either of our suggestions would have given you the display you wanted. Is this correct? Back to the problem of UpgradeStatus. When I point out that your searches do not produce Pending values, the big question is: What is in CompletedStatus? Does it give "Completed" for some ServerName, and "Pending" for others? And what is the field name that gives you ServerName? Is it Servers used in your first search? If both are true, and that ServerName and CompletedStatus appear in the same events, the solution is as simple as index=abc source="/opt/src/datasource.tmp"
| stats dc(Servers) as count by CompletedStatus
| eventstats sum(count) as total
| eval count = count . " (" . round(count / total * 100) . "%)"
| fields - total
| transpose header_field=CompletedStatus
| fields - column In other words, all that change from my previous answer is field names that I guess from the two meaningless searches. Here are my four commandments of asking answerable data analytics questions: Illustrate data input (in raw text, anonymize as needed), whether they are raw events or output from a search that volunteers here do not have to look at. Illustrate the desired output from illustrated data. Explain the logic between illustrated data and desired output without SPL. If you also illustrate attempted SPL, illustrate actual output and compare with desired output, explain why they look different to you if that is not painfully obvious. Volunteers are not your mind readers. It is unfair to ask unanswerable questions here.
... View more
