The eval command running on a per-event basis. This part of your search string: | eval calls = if(like(message, "%call%"), 1, 0) is setting the value of calls to either 1 or 0. So on some events, you are dividing by 0, which will produce an error. So let's talk about these lines: | eval errors = errors1 + errors2 + errors3 | eval allErrorsPerMile = round((errors*1000) / calls, 3) Are you actually intending to calculate allErrorsPerMile on a per-event basis? Or is this meant to be a value you are calculating across the sum of the errors in all events? If it's the latter, you'll need to do something like this instead: | stats sum(errors1) AS errors1 sum(errors2) AS errors2 sum(errors3) AS errors3 sum(calls) AS calls | eval errors=errors1 + errors2 + errors3 | eval allErrorsPerMile=if(calls>0, round((errors*1000)/calls, 3), "Error: Trying to divide by zero") By reversing the order of the stats and eval commands, you'll get totals across all events, rather than across individual events. ... View more