Calculate percentage from 2 tstats searches

[ftonen]

EDIT: The below search suddenly did work, so my issue is solved!

So I have two searches in a dashobard, but resulting in a number:

| tstats count AS "Count" from datamodel=my_first-datamodel (nodename = node.name.1) summariesonly=t prestats=true | stats dedup_splitvals=t count AS "Count"

| tstats count AS "Count2" from datamodel=my_second_datamodel where (nodename = node.name.2) summariesonly=t prestats=true | stats dedup_splitvals=t count AS "Count2"

Now I want to calculate with those results. I want to find out what percentage the first search is of the second. I have found other threads but they didn't work, the best I could come up with was this:
| tstats count AS "Count" from datamodel=my_first-datamodel (nodename = node.name.1) summariesonly=t prestats=true | stats dedup_splitvals=t count AS "Count"
| appendcols
[| tstats count AS "Count2" from datamodel=my_second_datamodel (nodename = node.name.2) summariesonly=t prestats=true | stats dedup_splitvals=t count AS "Count2"
]
| eval Perc=round((Count/Count2)*100,2)

Does anyone know? Thanks in advance!

[ftonen · Accepted solution]

I tried this one again and suddenly it did work. Apologies!

| tstats count AS "Count" from datamodel=my_first-datamodel (nodename = node.name.1) summariesonly=t prestats=true | stats dedup_splitvals=t count AS "Count"
| appendcols
[| tstats count AS "Count2" from datamodel=my_second_datamodel (nodename = node.name.2) summariesonly=t prestats=true | stats dedup_splitvals=t count AS "Count2"
]
| eval Perc=round((Count/Count2)*100,2)

[richgalloway]

@flonen If your problem is resolved, please accept an answer to help future readers.

[to4kawa]

| tstats count AS "Count" from datamodel=my_first-datamodel (nodename = node.name.1) summariesonly=t prestats=true 
| stats dedup_splitvals=t count AS "Count" 
| append 
    [| tstats count AS "Count2" from datamodel=my_second_datamodel (nodename = node.name.2) summariesonly=t prestats=true 
    | stats dedup_splitvals=t count AS "Count2" ] 
| eval Perc="T" 
| stats sum(Count) as Count sum(Count2) as Count2 by Perc 
| eval Perc=round((Count/Count2)*100,2)

Hi, folks. How about append

[gfreitas]

Depending what you want to display on your dashboard you might be looking for subsearches (as you're doing above) or post process searches/base searches. If you want to display let's say value 1 and value2 and then the percentage, all on separate panels, there are some ideas here: https://answers.splunk.com/answers/239159/multiple-base-searches-in-a-dasboard-with-post-pro.html and https://answers.splunk.com/answers/461853/how-to-use-multiple-base-searches-in-one-search.html.
Also, more information about post-process searches can be found here: https://docs.splunk.com/Documentation/Splunk/8.0.1/Viz/Savedsearches#Post-process_searches_2

[ftonen]

Thanks for your reponse!

I already have two panels with information, those are the 2 searches I mentioned in the beginning. I'm stuck at the point where I calculate with them, even tried making searches a variable. The links you provided did not discus the calculating part.

[gfreitas]

Ohh sorry, so not following exactly why it doesn't work. What results do you get?
Maybe you just want to display the Perc field, append this to the end of your search:
|fields Perc

[ftonen]

I previously had an error saying something along the lines of that you can't use real-time searching with tstats input. Now I retried the same search and suddenly it did work. Strange, but I'm happy!

Thanks for your help!