Can I run the below mstats command as 1 command?

Splunk Enterprise

Can I make the below mstats into one SPL? Below there are 2.

I am pulling data from the same metric. I have a "where" in one.

| mstats sum("mx.http.server.requests") as total WHERE "index"="murex_metrics" mx.env="feature/monitoring/nfr/new-log-metrics-19"
| appendcols 
    [ mstats sum("mx.http.server.requests") as declined WHERE "index"="murex_metrics" mx.env="feature/monitoring/nfr/new-log-metrics-19" status.code>=400
	 | appendpipe 
        [ stats count 
        | eval declined=0 
        | where count=0 
        | table declined ]] 
| eval percent_declined=100 * declined / total 
| table percent_declined

I looked at this question and I don't think I can use "stats style eval aggr functions"

| stats count(eval(ip=="37.25.139.34"))

https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-with-mstats/td-p/563751

So perhaps I need to run 2 mstats, I was hoping I could just run 1. However i think it is not possible for what i am trying to do.

Rob

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...

Are you a member of the Splunk Community?