how about this: |bucket _time span=1h|stats count(eval(flag="GREEN")) as GREEN count(eval(flag="RED")) as RED by _time location_code|eval percentage=round(GREEN/(GREEN+RED)*100,2)|fields - GREEN RED|eval {location_code}=percentage|fields - location_code percentage|stats values(*) as * by _time i worked off of this and it seemed to work: |makeresults|eval data="time=1506011682,location_code=A,flag=GREEN time=1506011682,location_code=A,flag=GREEN time=1506011682,location_code=A,flag=RED time=1506011682,location_code=B,flag=RED time=1506011682,location_code=C,flag=GREEN time=1506011682,location_code=C,flag=GREEN time=1506000882,location_code=A,flag=RED time=1506000882,location_code=A,flag=GREEN time=1506000882,location_code=A,flag=GREEN time=1506000882,location_code=B,flag=RED time=1506000882,location_code=C,flag=GREEN time=1506000882,location_code=C,flag=RED"|makemv data|mvexpand data|eval _raw=data|kv|eval _time=time|bucket _time span=1h|table _time location_code flag|stats count(eval(flag="GREEN")) as GREEN count(eval(flag="RED")) as RED by _time location_code|eval percentage=round(GREEN/(GREEN+RED)*100,2) ... View more