Adding a new row in stats using values from previous search?

[Vivekmishra01]

I want to add new row to my search result using values from the previous result. Basically I am counting few strings and I want to display percent of that matched string in a new row using some mathematical operators or function. Below is what I have done. My first query works fine but second query in append is giving error.

Error is: Error in 'eval' command: The expression is malformed. Expected AND.

index="12345" "Kubernetes.namespace"="testnamespace"
| bin _time
| stats count(eval(searchmatch("String1"))) AS Success
count(eval(searchmatch("string2"))) AS Sent
count(eval(searchmatch("string3"))) AS Failed
| append [ stats eval Success_percent= Success/(Success+Sent +Failed) AS Success
eval Sent_Percent= Sent/(Success+Sent +Failed) AS Sent
eval Failed_percent= Failed/(Success+Sent +Failed) AS Failed ]
| transpose 0 column_name="Status" | rename "row 1" as Count | rename "row 2" as "Percent"

[Vivekmishra01]

This is not exactly what I was looking for, but it helped. "appendpipe" exactly gave me what I was looking for. Thanks.

[richgalloway · Accepted solution]

I think you need the appendpipe command rather than append.  As @skramp said, however, the subsearch is rubbish so either command will fail.

...
| appendpipe [ eval Success_percent = Success/(Success+Sent +Failed),
    Sent_Percent= Sent/(Success+Sent +Failed), 
    Failed_percent= Failed/(Success+Sent +Failed) ]
...

[skramp]

Your syntax is invalid. By an append command you start a complete ausbrächte which could start with | search index=abcd … . And then an eval could follow but then you don’t need a stats in front of it.