How can I calculate both the total and IT_Managed values?

[POR160893]

Hey,

I am trying to use a subsearch with the loadjob command but it is failing:

Can you please help?


Many thanks,
Patrick

[richgalloway]

I think it's the main loadjob that is failing rather than the subsearch.

Run the subsearch by itself with | format on the end to see what is returned to the main search.  You'll probably find it's returning something like (TOTAL=n), which is not valid when tacked onto the end of a loadjob command.

[POR160893]

How can I calculate both the total and IT_Managed values then?
It has been 3 days and I have had no luck 🙄

[ITWhisperer]

Have you tried my suggestion from your duplicate question?

[ITWhisperer]

Don't do it this way!

The syntax you have used is often used to provide filtering to an index search, it doesn't apply to a loadjob command.

[POR160893]

Can you suggest another alternative to calculate the percentage?

[ITWhisperer]

https://community.splunk.com/t5/Dashboards-Visualizations/How-to-find-percentage-and-count-using-sta...