https://community.splunk.com/t5/Getting-Data-In/To-get-data-from-different-source-types/m-p/96362#M97453 <P>Try this</P> <PRE><CODE>sourcetype=XXXXX or sourcetype=YYYYYY | stats count(OrderTotal) as Orders dc(SessionID) as Visits | eval CVR =(Orders/Visits)*100 </CODE></PRE> <P>OR this, which is less efficient usually</P> <PRE><CODE>sourcetype=XXXXXX | stats count(OrderTotal) as Orders | appendcols [ search sourcetype=YYYYY | stats dc(SessionID) as Visits ] | eval CVR =(Orders/Visits)*100 </CODE></PRE> <P>Also, note that you used "visits" in one spot, and "Visits" in another. Field names are case-sensitive!</P> <P>HTH </P> Mon, 14 Oct 2013 03:04:30 GMT lguinn2 2013-10-14T03:04:30Z https://community.splunk.com/t5/Getting-Data-In/To-get-data-from-different-source-types/m-p/96361#M97452 <P>Hi,</P> <P>I am trying to calculate conversion rate using number of orders/visits. Number of visits from one sourcetype and visits are from different source type. So i have used join command. But i am not getting any output </P> <P>sourcetype=XXXXX | stats count(OrderTotal) as Orders | join append[search sourcetype=YYYYY | stats dc(SessionID) as visits] | eval CVR =(Orders/Visits)*100 | table CVR</P> <P>When i take out table CVR i can see that the 2 stats output values separately. But i want to use those and calculate the CVR and just output that value alone. Any help is much appreciated. </P> Sun, 13 Oct 2013 22:24:28 GMT https://community.splunk.com/t5/Getting-Data-In/To-get-data-from-different-source-types/m-p/96361#M97452 xvxt006 2013-10-13T22:24:28Z https://community.splunk.com/t5/Getting-Data-In/To-get-data-from-different-source-types/m-p/96362#M97453 <P>Try this</P> <PRE><CODE>sourcetype=XXXXX or sourcetype=YYYYYY | stats count(OrderTotal) as Orders dc(SessionID) as Visits | eval CVR =(Orders/Visits)*100 </CODE></PRE> <P>OR this, which is less efficient usually</P> <PRE><CODE>sourcetype=XXXXXX | stats count(OrderTotal) as Orders | appendcols [ search sourcetype=YYYYY | stats dc(SessionID) as Visits ] | eval CVR =(Orders/Visits)*100 </CODE></PRE> <P>Also, note that you used "visits" in one spot, and "Visits" in another. Field names are case-sensitive!</P> <P>HTH </P> Mon, 14 Oct 2013 03:04:30 GMT https://community.splunk.com/t5/Getting-Data-In/To-get-data-from-different-source-types/m-p/96362#M97453 lguinn2 2013-10-14T03:04:30Z https://community.splunk.com/t5/Getting-Data-In/To-get-data-from-different-source-types/m-p/96363#M97454 <P>I tried your first solution initially and may be i might have missed the case sensitivity. Thank you HTH it is working now.</P> Mon, 14 Oct 2013 10:38:00 GMT https://community.splunk.com/t5/Getting-Data-In/To-get-data-from-different-source-types/m-p/96363#M97454 xvxt006 2013-10-14T10:38:00Z