index=$index$ sourcetype=$sourcetype$ $string1$ . . | fillnull value=FALSE | stats count(email) AS TOTAL count(eval(authenticated="TRUE")) AS auth_count count(eval(cancelled="TRUE")) AS cancelled_count count(eval(promoted="TRUE")) AS PROVISIONED | eval AUTH_DROP_OUT=TOTAL-auth_count | eval USER_CANCELLED=auth_count-cancelled_count | eval LOGIN_DROP_OUT=TOTAL-AUTH_DROP_OUT-USER_CANCELLED-PROVISIONED | table TOTAL,AUTH_DROP_OUT,LOGIN_DROP_OUT,USER_CANCELLED,PROVISIONED | transpose | rename column AS ActionTaken "row "1 AS Count | eval ActionTaken=ActionTaken." : ".Count ... View more