https://community.splunk.com/t5/Splunk-Search/How-to-combine-2-search-results-and-calculate-error-rate/m-p/266318#M80061 <P>I am trying to determine the error rate.</P> <P>Total Count per URI: </P> <PRE><CODE>index=applogsprd java_class="*content.common.spring.LoggingInterceptor*” uri="*/api/v*" | fields uri | stats Count as count, by uri </CODE></PRE> <P>Error Count per URI: </P> <PRE><CODE>index=applogsprd java_class="*content.ws.rest.v1.error.ErrorHandler*" uri="*/api/v*" | fields uri | stats Count as errorCount, by uri </CODE></PRE> <P>The result I'm looking for is a table:<BR /> uri , totalCount, errorCount, error rate (errorCount/totalCount)</P> <P>I've tried appendcols, but can't seem to make that work.</P> Sat, 21 May 2016 08:29:45 GMT haleefe 2016-05-21T08:29:45Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-2-search-results-and-calculate-error-rate/m-p/266318#M80061 <P>I am trying to determine the error rate.</P> <P>Total Count per URI: </P> <PRE><CODE>index=applogsprd java_class="*content.common.spring.LoggingInterceptor*” uri="*/api/v*" | fields uri | stats Count as count, by uri </CODE></PRE> <P>Error Count per URI: </P> <PRE><CODE>index=applogsprd java_class="*content.ws.rest.v1.error.ErrorHandler*" uri="*/api/v*" | fields uri | stats Count as errorCount, by uri </CODE></PRE> <P>The result I'm looking for is a table:<BR /> uri , totalCount, errorCount, error rate (errorCount/totalCount)</P> <P>I've tried appendcols, but can't seem to make that work.</P> Sat, 21 May 2016 08:29:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-2-search-results-and-calculate-error-rate/m-p/266318#M80061 haleefe 2016-05-21T08:29:45Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-2-search-results-and-calculate-error-rate/m-p/266319#M80062 <P>Try this</P> <PRE><CODE>index=applogsprd uri="/api/v" | stats count(eval(java_class="content.common.spring.LoggingInterceptor”)) as count count(eval(java_class="content.ws.rest.v1.error.ErrorHandler")) as error | eval errorRate=error/count </CODE></PRE> Sat, 21 May 2016 14:45:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-2-search-results-and-calculate-error-rate/m-p/266319#M80062 sundareshr 2016-05-21T14:45:41Z