https://community.splunk.com/t5/Splunk-Search/Merging-Splunk-Searches/m-p/427755#M168475 <P>Hi Pros,</P> <P>I want to merge results of two queries together and need some help in achieving the best possible way to do it...</P> <P>index=* sourcetype=* | top sourcetype limit=200<BR /> index=* sourcetype=* | stats count(host) by sourcetype </P> <P>I want to show.... following results...</P> <P>Sourcetype Hosts(number of hosts contributing to the sourcetype) Count(Event count) Percentage (based on time)</P> Fri, 06 Jul 2018 06:07:09 GMT memow8 2018-07-06T06:07:09Z https://community.splunk.com/t5/Splunk-Search/Merging-Splunk-Searches/m-p/427755#M168475 <P>Hi Pros,</P> <P>I want to merge results of two queries together and need some help in achieving the best possible way to do it...</P> <P>index=* sourcetype=* | top sourcetype limit=200<BR /> index=* sourcetype=* | stats count(host) by sourcetype </P> <P>I want to show.... following results...</P> <P>Sourcetype Hosts(number of hosts contributing to the sourcetype) Count(Event count) Percentage (based on time)</P> Fri, 06 Jul 2018 06:07:09 GMT https://community.splunk.com/t5/Splunk-Search/Merging-Splunk-Searches/m-p/427755#M168475 memow8 2018-07-06T06:07:09Z https://community.splunk.com/t5/Splunk-Search/Merging-Splunk-Searches/m-p/427756#M168476 <P>Hi @memow8,</P> <P>Try this</P> <PRE><CODE>index="your index"|stats count(host) as no_of_hosts by sourcetype|eventstats sum(no_of_hosts) as total|eval perc=round((no_of_hosts/total)*100,2)|sort -no_of_hosts </CODE></PRE> Fri, 06 Jul 2018 13:19:31 GMT https://community.splunk.com/t5/Splunk-Search/Merging-Splunk-Searches/m-p/427756#M168476 renjith_nair 2018-07-06T13:19:31Z