Combining 2 Queries Using Same Field

[PaintItParker]

I have two queries. One gets the total number of events using the message field:

index=my_index sourcetype=my_sourcetype
| stats count(message) AS TotalA
| table TotalA

And the other uses multiple regex statements and the message field to get the total number of errors:

index=my_index sourcetype=my_sourcetype
| regex message = "(?:(^Problem.*)|((?i).*Issue.*)|((?i).*Error.*))"
| stats count(message) AS TotalB
| table TotalB

My goal is to have TotalA and TotalB side by side in a table. I would then like to divide TotalA by TotalB to get a ratio and display that alongside TotalA and TotalB in the table.

How could I go about combining these? Thanks!

[ericjorgensenjr · Accepted solution]

This should work:

index=my_index sourcetype=my_sourcetype 
| eval isProblem=if(match(message,"(?i)(?:problem)|(?:issue)|(?:error)"),1,0) 
| stats count as totalMessage, sum(isProblem) as countErrors
| eval ratioErrors = round(countErrors/totalMessage,4)

[PaintItParker]

Thank you so much!