Hello experts. I tried to execute the query, as described here https://answers.splunk.com/answers/106906/how-to-perform-math-on-single-values.html In my case, too, there are two requests. 1st search: index=ns SUBMIT_SM REQUEST host="notif*" | rex field=_raw "CID\:(?<CID>.*)\ actor-id" | dedup CID | stats count as part 2nd search: index=ns SUBMIT_SM REQUEST host="notif*" | stats count as uniq I tried to combine these requests into one to calculate the ratio | multisearch [ search index=ns SUBMIT_SM REQUEST host="notif*" | rex field=_raw "CID\:(?<CID>.*)\ actor-id" | dedup CID | eval marker="s" ] [ search index=ns SUBMIT_SM REQUEST host="notif*" | eval marker="o" ] | stats count(eval(marker=="s")) as part count(eval(marker=="o")) as uniq | eval velocity=(part/uniq)*100) I receive an error: Error in 'multisearch' command: Multisearch subsearches may only contain purely streaming operations (subsearch 1 contains a non-streaming command.) The search job has failed due to an error. You may be able to see the job in the Job Inspector. I tried it differently index=ns SUBMIT_SM REQUEST host="notif*" | stats count as part | append [ search index=ns SUBMIT_SM REQUEST host="notif*" | rex field=_raw "CID\:(?<CID>.*)\ actor-id" | dedup CID | stats count as uniq] | eval velocity=part/uniq But velocity was not calculated Help ... View more