Hi @francine0, you coud try a different approach: index="raw_es2" (message="[Login][Password]Login simplified active." OR message="[Login][Password]Login simplified active." OR message="[Login][Password]Login simplified active.") | eval action=case(message="[Login][Password]Login simplified active.", "Start", message="[Login][Password]Login simplified active.", "Success", message="[Login][Password]Login simplified active.", "Error") | stats count(eval(action="Start")) AS Calls count(eval(action="Success")) AS Success count(eval(action="Error")) AS Error | eval PercentualErrors=round(Error/Calls*100,2), PercentualSuccess=round(Success/Calls*100,2) | table Calls Success Error PercentualErrors PercentualSuccess Ciao. Giuseppe ... View more