I have a lookup table with daily records which includes: area, alarm description, date, number of bags per area and for that specific day (repetitive number). There is a timestamp for each alarm, and a bag column repeating the total bags for that day (same number appears multiple times because the same day has multiple alarm rows). I want to:  1) compute the total number of bags for the whole 3-month period. 2) compute the total number of alarm events (counted as total occurrences across 3 months). What is the best approach in Splunk enterprise to get both in the same final stats result? Example of scenario: AREA ALARM DESCRIPTION TOTAL DAILY BAGS TIME 1111 TRIGGER 18600 01/03/2024 1111 TRIGGER 18600 01/03/2024 1222 FAILURE 18600 01/03/2024 1323 FAILURE 18600 01/03/2024 1323 HAC 18600 01/03/2024 1222 FAILURE 33444 01/02/2024 1111 FAILURE 33444 01/02/2024 1323 TRIGGER 33444 01/02/2024 ... View more

Hello everyone!  I am currently navigating and learning how to calculate and use specific commands. I am currently trying to add new columns to a table where I want to add the average of ghost% and missing% based on a location.  However, it shows empty cells. Also, I want to show the values eventually in a chart in percentages and not decimals. Can anyone guide me in what is wrong with this query? Thank you!                                                                    chart count by AREAID event | | eval Ghost=max(0,Ghost-Missing) | eval "Ghost %"=Ghost/TotalTubs*100,"Missing %"=Missing/TotalTubs*100 | fields AREAID "Missing" "Ghost" "Missing %" "Ghost %" | stats avg(Missing) as avg_missing, avg(Ghost) as avg_ghost, by AREAIDsum(TotalTubs) as total_tubs by AREAID | eval "Average Missing %"=avg_missing/total_tubs*100, "Average Ghost %"=avg_ghost/total_tubs*100 | table AREAID avg_missing avg_ghost total_tubs "Average Missing %" "Average Ghost %" | fields "AREAID", "Average Ghost %", "Average Missing %", "Ghost %", "Missing %", "total_tubs" ... View more