You would need to add eval with stats some thing like
| stats count(eval(rslt=="found")) as cache_hit, count as total_count | eval ratio=cache_hit/total_count
,we will need add eval in stats something like:
| stats count(eval(rslt=="found")) as cache_hit, count as total_count | eval ratio=cache_hit/total_count
... View more