hi
Can I make the below mstats into one SPL? Below there are 2.
I am pulling data from the same metric. I have a "where" in one.
| mstats sum("mx.http.server.requests") as total WHERE "index"="murex_metrics" mx.env="feature/monitoring/nfr/new-log-metrics-19"
| appendcols
[ mstats sum("mx.http.server.requests") as declined WHERE "index"="murex_metrics" mx.env="feature/monitoring/nfr/new-log-metrics-19" status.code>=400
| appendpipe
[ stats count
| eval declined=0
| where count=0
| table declined ]]
| eval percent_declined=100 * declined / total
| table percent_declined
I looked at this question and I don't think I can use "stats style eval aggr functions"
| stats count(eval(ip=="37.25.139.34"))
https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-with-mstats/td-p/563751
So perhaps I need to run 2 mstats, I was hoping I could just run 1. However i think it is not possible for what i am trying to do.
Rob