Hi Team, Is there an alternative to count all the events to 'eventstats' using it results in data loss if exceed the duration only works fine until 6 or 7 hours so. My search is basis 'transactionStatus = all', it works fine if I specify it as 'Failed' but using fail it doesnt calculate percentage by Total...but only by Total failed events or data count. My BaseSearch.... **transactionStatus=*** earliest=-**1d** | eventstats count as "Total" | rex field=_raw "Error response from Sabre pad for getDetails : ErrorType : BusinessLogic Code : ERR.SWS.HOST.ERROR_IN_RESPONSE, Message\s*:\s*(?.+)" | rex field=vldCxrs "carrierCode=(?..)" | search carrierCode=* | stats count(eval(transactionStatus="FAILED")) as "Failed_Count" by Total, ErrorMsg, tpid, carrierCode | eval Error_Percent=round((Failed_Count/Total)*100,2) | fields tpid, carrierCode, ErrorMsg, Error_Percent, Failed_Count, Total | sort -Failed_Count Regards Nishant ... View more