topic Re: Help joining the 2 below searches in Splunk Search

Help joining the 2 below searches

tomjb94 — Mon, 02 Sep 2024 15:59:11 GMT

Hi -

We have a requirement to join the below eval statement searches, would it be possible if someone could assist with the solution please?

eval search 1 = index="wpg" host=*pz-pay* OrderSummary | stats count AS "Total" eval search 2 = index="wpg" host=*pz-pay* OrderSummary AND "Address is invalid, it might contain a card number") | stats count AS "Failure" eval result =( search 1/search 2)*100

Thanks,

Tom

Re: Help joining the 2 below searches

ITWhisperer — Mon, 02 Sep 2024 15:41:22 GMT

Try something llke this

index="wpg" host=*pz-pay* OrderSummary | eventstats count AS "Total" | search "Address is invalid, it might contain a card number" | stats count AS "Failure" values(Total) as Total | eval result = (Total/Failure)*100

Re: Help joining the 2 below searches

richgalloway — Mon, 02 Sep 2024 15:56:42 GMT

Try this

(index="wpg" host=*pz-pay*) (OrderSummary OR (OrderSummary AND "Address is invalid, it might contain a card number")) | eval is_invalid=if(searchmatch("Address is invalid, it might contain a card number"), 1, 0) | stats count AS "Total", count(eval(is_invalid=1)) as Failure | eval result = (Failure * 100)/Total