Using a simple example: count the number of events for each host name ... | timechart count BY host > ... | timechart count BY host > > This search produces this results table: > > _time host1 host2 host3 > > 2018-07-05 1038 27 7 > 2018-07-06 4981 111 35 > 2018-07-07 5123 99 45 > 2018-07-08 5016 112 22 What I want is to add columns to show the total events for that day and the percentage of each http status code. > _time host1 host2 host3 host1_percent host2_percent > > 2018-07-05 1038 27 7 92.8 3.1 > 2018-07-06 4981 111 35 94.5 4.5 > 2018-07-07 5123 99 45 95.2  3.2 > 2018-07-08 5016 112 22    96.2          3.2   I tried ... | timechart count BY host | eval total= host1 + host2 + host3 | eval host1_percent = host1 / total | eval host2_percent = host2 / total | eval host3_percent = host3 / total | table _time, host1_percent, host2_percent, host3_percent This works most of the time, but I found out if for certain day, a host was offline (no record for a particular host), then the search doesn't work (return blank results), I have to remove that particular host from the "total = host1 + host2 + host3" to get it to work. So my question is: is there a way to get the total number of record for for every day (row) without having to add them together, e.g. replace the "total = host1 + host2 + host3" with a count or sum, I tried couple of thing, none of them work. ... View more

the events data set looks like this: 2:05:34.067 PM 3DS: auth_validate_success Proceeding with payment authorization country=DE, currency=EUR 2:05:33.220 PM 3DS: auth_validate country=DE, currency=EUR 1:40:28.684 PM 3DS: auth_validate_success Proceeding with payment authorization country=CY, currency=EUR 1:40:28.237 PM 3DS: auth_validate country=CY, currency=EUR 1:33:40.604 PM 3DS: auth_validate_success Proceeding with payment authorization country=CY, currency=EUR 1:33:40.108 PM 3DS: auth_validate country=CY, currency=EUR 1:07:06.813 PM 3DS: auth_validate_success Proceeding with payment authorization country=DE, currency=EUR 1:07:06.147 PM 3DS: auth_validate country=DE, currency=EUR 1:03:51.530 PM 3DS: auth_validate_success Proceeding with payment authorization country=DE, currency=EUR 1:03:51.117 PM 3DS: auth_validate country=DE, currency=EUR 12:11:21.673 AM 3DS: auth_validate_success Proceeding with payment authorization country=DE, currency=EUR 12:11:21.017 AM 3DS: auth_validate country=DE, currency=EUR my search query: "3DS: auth_validate country" OR "3DS: auth_validate_success" OR "3DS: auth_validate_error" OR "3DS: auth_validate_exception" | chart count(eval(searchmatch("3DS: auth_validate country"))) AS Validate_total count(eval(searchmatch("3DS: auth_validate_success"))) AS Validate_success count(eval(searchmatch("3DS: auth_validate_error"))) AS Validate_error count(eval(searchmatch("3DS: auth_validate_exception"))) AS Validate_exception by country | table country, Validate_total, Validate_success, Validate_error, Validate_exception, | rename Validate_total as "Total Validate Calls" | rename Validate_success as "Validate Success" | rename Validate_error as "Validate Error" | rename Validate_exception as "Validate Exception " | sort - Validate_total but the returned table shows double amount of the first string, I was expecting the Total Validate calls to be 2 and 4 too. country Total Validate Calls Validate Success Validate Error Validate Exception CY 4 2 0 0 DE 8 4 0 0 I can't figure out why. First I suspected it to be a string indexing issue, but if I use the same string in a separate query, it works fine. Any help greatly appreciated! ... View more