Hi Everyone, I have a query that produces table 1 below. | from inputlookup:"incident.csv" | where caused_by >= " " | stats count values(caused_by) by assignment_group I'd like to make the table more useful by reflecting it as table 2 and 3. I tried : | from inputlookup:"incident.csv" | where caused_by >= " " | stats count values(caused_by) by assignment_group | mvexpand values(caused_by) but it did not give the desired results. Any help would be appreciated. ... View more

I'm having a difficult time calculating a percentage based on two reports (searches). Search 1 | inputlookup mydata.csv | where category= "category" AND assignment_group="myteam" AND yyyy_mm="$Datedropdown$" | stats count as myteamstotal Search 2 | inputlookup mydata.csv | where category= "category" AND yyyy_mm="$Datedropdown$" | stats count as total I'd like to calculate a percentage | eval percent=(myteamstotal/total)*100 I tried this and got 0 as a result: | inputlookup GCC-SNOW_01012018_12312018.csv | where category= "category" AND assignment_group="myteam" AND yyyy_mm="$Datedropdown$" | stats count as myteamstotal | where category= "category" AND yyyy_mm="$Datedropdown$" | stats count as total | eval percent=(myteamstotal/total)*100 How can I calculate the percentage? ... View more