Thanks @richgalloway  you're right. It worked   index=main source="employees_data.csv" | fields - source* sourcetype* splunk* eventtype tag* index* linecount* punct* timestamp* _time _raw | foreach * [ eval <<FIELD>>_isNull = if(isnull('<<FIELD>>'), 1, 0) ] | stats sum(*_isNull) as * | transpose column_name="missing_logs" | rename "row 1" as nullCount | eventstats sum(nullCount) as total_events | eval nullPercent = round((nullCount / total_events) * 100, 2) | fields - total_events | where nullCount > 0 | rename nullCount as "Total Missing", nullPercent as "Missing Percentage", missing_logs as "Missing Logs"   ... View more

@richgalloway  thanks for your answer. But I want to calculate nullPercent based on total_events (Total count of all events) not based on total count of nulls (| eventstats sum(nullCount) as total) ... View more

Thanks @ITWhisperer  ... View more

@ITWhisperer  you're right. Thanks ... View more

Thanks @ITWhisperer  I've used addtotals. Just one more thing left now how can I transform last  row Trend to become last column ? ... View more

Thanks @ITWhisperer  for your quick answer addtotals will give the total of the 3 columns for each row while in this case only the total of last two columns are needed. Any workaround ? Besides, transposing adds a new row in the top while I want the second row to be the first one (header) of the table. Any idea ? thanks ... View more

Awesome @livehybrid , Thanks ... View more

Thanks @ITWhisperer , it's good to know that it's doable using Classic SimpleXML Dashboard. Hopefully it will also be possible using Dashboard Studio later on. For now I'll stick with it. ... View more

Thanks @ITWhisperer  for your quick answer. I'm a bit new to Splunk, so I started straight away with dashboard studio as it's easier. So if there's a work around within dashboard studio, that would be perfect. Otherwise I'll start also looking at classic dashboard and classic SimpleXML. Is it possible to switch in both directions between classic dashboard (xml) and dashboard studio (json) ? ... View more

Hi @ITWhisperer  I'm using dashboard studio. Here is my source code { "title": "ButterCup Game", "description": "", "inputs": { "input_global_trp": { "options": { "defaultValue": "0,", "token": "global_time" }, "title": "Global Time Range", "type": "input.timerange" }, "input_wAcCA79n": { "options": { "defaultValue": "*", "items": [ { "label": "All", "value": "*" }, { "label": "ACCESSORIES", "value": "ACCESSORIES" }, { "label": "ARCADE", "value": "ARCADE" }, { "label": "SHOOTER", "value": "SHOOTER" }, { "label": "SIMULATION", "value": "SIMULATION" }, { "label": "SPORTS", "value": "SPORTS" }, { "label": "STRATEGY", "value": "STRATEGY" }, { "label": "TEE", "value": "TEE" } ], "token": "dd_token" }, "title": "Game Categories", "type": "input.dropdown" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } } } }, "visualizations": { "viz_t3jLGiwh": { "dataSources": { "primary": "ds_V5vxqc3K" }, "title": "Sales count by product", "type": "splunk.pie" } }, "dataSources": { "ds_V5vxqc3K": { "name": "CategorySales", "options": { "query": "index=web sourcetype=\"access_combined\" status=200 product_name=* categoryId=$dd_token$\n| stats count by product_name", "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } }, "type": "ds.search" } }, "layout": { "globalInputs": [ "input_global_trp", "input_wAcCA79n" ], "layoutDefinitions": { "layout_1": { "options": { "height": 960, "width": 1440 }, "structure": [ { "item": "viz_t3jLGiwh", "position": { "h": 400, "w": 1440, "x": 0, "y": 0 }, "type": "block" } ], "type": "grid" }, "layout_AfZAhYi7": { "structure": [], "type": "grid" } }, "options": {}, "tabs": { "items": [ { "label": "Inventory", "layoutId": "layout_1" }, { "label": "Sales", "layoutId": "layout_AfZAhYi7" } ] } } } ... View more

@ITWhisperer  you're right, the correct source type is  access_combined   ... View more