"XXX targeting service enabled" | stats count as ALL | appendcols [search "exception calling XXX targeting" | stats count as EXC] | eval ratio=ALL/EXC
Search works fine and generates correct ratio when no sampling is made, but if I want to sample, the outer search is fine but the inner runs through the complete event space.
Easy enough to interpret but it'd be good to know if there's a way to enforce sampling throughout the complete search.
Not sure if I understand your question correctly, but the stats command is not a good candidate for event sampling. Please refer to the documentation here:
View solution in original post
Ah yes, I'd forgotten about that note. Thanks.