i have fixed the problem by below search: **| eventstats count(Q) as total |stats count as count by Q total|eval percent=round(count/total*100,2) |table Q,percent thanks. ... View more

Replace your delta with this: ... | streamstats current=f window=1 last(sum) as last_sum | eval dif = sum - last_sum | eval percentage = round(dif/last_sum, 1) ... View more

I would do this yoursearchhere | chart sum(sum_count) as current_count by month | streamstats last(current_count) as last_count current=f window=2 | eval deviation = round( (current_count - last_count) / last_count, 3) | fields - last_count | rename current_count as "Number of count" ... View more

The problem is probably the " after action= you need to either to escape that by putting a \ in front of it or remove it at all. You can use the below search to test. AppLoader |rex field=_raw "action=.*?\((?<version>[^\s\@]+)" |stats latest(version) by table ... View more

The problem is that your subsearch is trying to use fields that are presented from the base search. A stats command will remove the fields presented to the next command, so you are trying to count server_name , but that isn't listed as an output field of the base search. You can try using eventstats to calculate the sum_touch_count . <search id="1"><query><![CDATA[*** | eval day=strftime(_time, "%Y-%m-%d") | rex field=_raw "server_name\=\"(?<retailer>([a-zA-Z]+)|(\d-\d+\s+))" | eventstats sum(touch_count) as sum_touch_count by day, retailer]]></query></search> <search base="1><query>chart dc(server_name) AS "Distinct_Count_server", latest(sum_touch_count) AS sum_touch_count over day by retailer |eval avg= sum_touch_count/Distinct_Count_server |eval avg=round(avg,0) ... View more