https://community.splunk.com/t5/Splunk-Search/Joining-two-queries-and-getting-a-percentage/m-p/107592#M27964 <P>Try something like this:</P> <PRE><CODE>index="norlogs" sourcetype="devicelog" category="NSException" OR category="FinishLaunching" | eval A=if(category=="NSException", 1, 0) | eval B=if(category=="FinishLaunching", 1, 0) | stats sum(A) as TotalA sum(B) as TotalB | eval pct=TotalB/TotalA </CODE></PRE> Fri, 26 Apr 2013 18:49:03 GMT emiller42 2013-04-26T18:49:03Z https://community.splunk.com/t5/Splunk-Search/Joining-two-queries-and-getting-a-percentage/m-p/107591#M27963 <P>I have two queries that I am running and I want to take the results / Count of these queries and divide them. I have seen several variances but I am still having issues trying to get my search correct.</P> <P>Here is an example of my queries:</P> <P>index=norlogs sourcetype="devicelog" category="NSException, on wi-fi:"</P> <P>index=norlogs sourcetype="devicelog" category="FinishLaunching"</P> <P>I would like to divide the first query by the last query and display a percentage. What would be the best way to accomplish this.</P> <P>This is working but I am not getting percentages</P> <P>index=norlogs sourcetype="devicelog" category="NSException"| stats count as TotalA | appendcols [search index=norlogs sourcetype="devicelog" category="FinishLaunching" | stats count as TotalB] | eval Total=TotalB/TotalA</P> Fri, 26 Apr 2013 18:37:39 GMT https://community.splunk.com/t5/Splunk-Search/Joining-two-queries-and-getting-a-percentage/m-p/107591#M27963 paul_1994 2013-04-26T18:37:39Z https://community.splunk.com/t5/Splunk-Search/Joining-two-queries-and-getting-a-percentage/m-p/107592#M27964 <P>Try something like this:</P> <PRE><CODE>index="norlogs" sourcetype="devicelog" category="NSException" OR category="FinishLaunching" | eval A=if(category=="NSException", 1, 0) | eval B=if(category=="FinishLaunching", 1, 0) | stats sum(A) as TotalA sum(B) as TotalB | eval pct=TotalB/TotalA </CODE></PRE> Fri, 26 Apr 2013 18:49:03 GMT https://community.splunk.com/t5/Splunk-Search/Joining-two-queries-and-getting-a-percentage/m-p/107592#M27964 emiller42 2013-04-26T18:49:03Z https://community.splunk.com/t5/Splunk-Search/Joining-two-queries-and-getting-a-percentage/m-p/107593#M27965 <P>Another working solution --</P> <PRE><CODE>index=norlogs sourcetype=devicelog category="NSException" OR category="FinishLaunching" | stats count by sourcetype,category | xyseries sourcetype, category, count | eval pct=NSException / FinishLaunching </CODE></PRE> Fri, 26 Apr 2013 18:57:10 GMT https://community.splunk.com/t5/Splunk-Search/Joining-two-queries-and-getting-a-percentage/m-p/107593#M27965 dwaddle 2013-04-26T18:57:10Z https://community.splunk.com/t5/Splunk-Search/Joining-two-queries-and-getting-a-percentage/m-p/107594#M27966 <P>(yay IRC!)</P> Fri, 26 Apr 2013 18:57:36 GMT https://community.splunk.com/t5/Splunk-Search/Joining-two-queries-and-getting-a-percentage/m-p/107594#M27966 dwaddle 2013-04-26T18:57:36Z https://community.splunk.com/t5/Splunk-Search/Joining-two-queries-and-getting-a-percentage/m-p/107595#M27967 <P>For some reason I could not get this working for me..</P> <P>Are these the categories? eval pct=NSException / FinishLaunching</P> <P>Also if my categories are more like this " NSexception 222: helpme" will the above still work?</P> <P>Thanks!</P> Fri, 26 Apr 2013 20:07:47 GMT https://community.splunk.com/t5/Splunk-Search/Joining-two-queries-and-getting-a-percentage/m-p/107595#M27967 paul_1994 2013-04-26T20:07:47Z https://community.splunk.com/t5/Splunk-Search/Joining-two-queries-and-getting-a-percentage/m-p/107596#M27968 <P>Yay.. thanks I was able to use this solution.</P> Fri, 26 Apr 2013 20:08:09 GMT https://community.splunk.com/t5/Splunk-Search/Joining-two-queries-and-getting-a-percentage/m-p/107596#M27968 paul_1994 2013-04-26T20:08:09Z