Hi All, we have a scenario to throw an alert if  System error rate exceeds 5%  i.e. (#system errors / #total volume)*100% . How to get the count of total events and system errors then calculate the percentage based on count as per above formula. Ex : Query for total volume : sourcetype="sfdc:transaction_log__c" | eval message = "b2cforce-liveperson" | where like(_raw,"%".message."%") Query for System errors  :  sourcetype="sfdc:transaction_log__c" | eval message = "userId Retrieval Failure" | where like(_raw,"%".message."%") ... View more