https://community.splunk.com/t5/Splunk-Search/Eval-count-in-two-searches/m-p/291347#M162830 <P>Give this a try</P> <PRE><CODE>index=servers sourcetype=json (appName="*" AND appName!="*Server*" AND appName!="*Service*") locId=* (level=Warning OR level=Error OR level=Critical OR level=Information) bdy.msg="Scanner*" | eval level=if(level="Information",level,"NonInformation") | top 50 appName msg bdy.ex.Msg by level showperc=f | eval Info=if(level="Information",count,null()) | eval NonInfo=if(level!="Information",count,null()) | stats values(Info) as Info values(NonInfo) as NonInfo by appName msg bdy.ex.Msg | addcoltotals | eval Ratio=Info/NonInfo </CODE></PRE> Mon, 19 Feb 2018 22:47:25 GMT somesoni2 2018-02-19T22:47:25Z https://community.splunk.com/t5/Splunk-Search/Eval-count-in-two-searches/m-p/291346#M162829 <P>Hi,</P> <P>I have a search that lists top 50 events based on the following search :</P> <P>index=servers sourcetype=json appName="<EM>" AND appName!="*Server</EM>" AND appName!="<EM>Service</EM>") locId=* level=Warning OR level=Error OR level=Critical) bdy.msg="Scanner*"<BR /> top 50 appName level msg bdy.ex.Msg | addcoltotals | fields - percent</P> <P>This give me top 50 events with their count. I have another search with slight change :</P> <P>index=servers sourcetype=json appName="<EM>" AND appName!="*Server</EM>" AND appName!="<EM>Service</EM>") locId=* level=Information bdy.msg="Scanner*"<BR /> top 50 appName level msg bdy.ex.Msg | addcoltotals | fields - percent</P> <P>only thing changing is Level . Now i have to calculate the ratio of both the counts from two searches. how can i do that. any help is highly appreciated.</P> <P>Thanks<BR /> Rohit</P> Tue, 29 Sep 2020 18:05:45 GMT https://community.splunk.com/t5/Splunk-Search/Eval-count-in-two-searches/m-p/291346#M162829 macadminrohit 2020-09-29T18:05:45Z https://community.splunk.com/t5/Splunk-Search/Eval-count-in-two-searches/m-p/291347#M162830 <P>Give this a try</P> <PRE><CODE>index=servers sourcetype=json (appName="*" AND appName!="*Server*" AND appName!="*Service*") locId=* (level=Warning OR level=Error OR level=Critical OR level=Information) bdy.msg="Scanner*" | eval level=if(level="Information",level,"NonInformation") | top 50 appName msg bdy.ex.Msg by level showperc=f | eval Info=if(level="Information",count,null()) | eval NonInfo=if(level!="Information",count,null()) | stats values(Info) as Info values(NonInfo) as NonInfo by appName msg bdy.ex.Msg | addcoltotals | eval Ratio=Info/NonInfo </CODE></PRE> Mon, 19 Feb 2018 22:47:25 GMT https://community.splunk.com/t5/Splunk-Search/Eval-count-in-two-searches/m-p/291347#M162830 somesoni2 2018-02-19T22:47:25Z