Try this:   | timechart count as SLO count(eval(durationInMinutes<60)) as Achieved | eval Percent=round(Achieved*100/SLO, 2) | timechart Percent   The original example didn't work as expected because the SLO field in the denominator no longer existed after the |timechart command.  You would need count(SLO) as SLO. The second example didn't work because the as clause needs to be outside whatever stats command you're using and the second count() was missing an eval.  For example:   | timechart count(eval(durationInMinutes<60)) AS Achieved count(eval(durationInMinutes>=60)) as Fail     ... View more

How many results are returned by the 7d and 30d base searches?  If it is in excess of 500,000 then Splunk will silently ignore all but the first 500k.  The documentation also recommends using a transforming search as your base search.   ... View more

@madhav_dholakiayes if no limit is specified with the |sort command then it will only return 10k results.  So your subsequent |dedup and |chart commands were only looking at 10k results instead of the full data set returned by the initial search. ... View more

I'm using an older version of DB Connect but when getting the "not a valid month" error I find that the DB connect logs also had the message "ORA-01013: user requested cancel of current operation" at the same time which I know is the message DB Connect gives when the timeout value is reached.  So generally increasing the Query Timeout will fix the problem for me. ... View more