Hello, Thanks for the tip, it was helpful. Although I got a different result when I executed and did not get the percentage, but I did some twakings to finally get the percentage using this index="first_index" sourcetype="mysource" (request.path="my/path/*" OR request.path="my/other/path/*") NOT (request.path="not/my/path" OR request.path="not/my/path") response | eval expired=if((now() > 'response.data.expiration'),1,0) | table _time, request.data.common_name, expired, auth.metadata.role_name | rename request.data.common_name as cn | search "auth.metadata.role_name"="myrole" | stats count as count1 | appendcols [ search index="second_index" | stats count by auth.metadata.role_name | dedup auth.metadata.role_name | stats count as count2] | eval PercenCount=round((count1/count2)*100) I see the correct percentage. However, when I select "pie chart" from the viaualization result, I only see one circle with the percentage, instead of seeing two pies. is there a way to make the pie chart show? I get the expected result when I use filler gauge, but not sure why not for pie? Thanks
... View more