Combining two searches to present a single percentage

[aputz]

I would like to be able to combine the following two searches or at least be able to reference the output of the searches to display them as a ratio or percentage of "count/sum(RX)" broken up by splunk indexers:

source="netstat" | chart sum(RX) by splunk_server

sourcetype="threats" | chart count by splunk_server

These searches both reference different sources and they currently are displayed by splunk indexer in a table.

Any help is much appreciated, thank you for any help.

[Stephen_Sorkin · Accepted solution]

I'd recommend using OR to combine the searches:

source=netstat OR sourcetype=threats
| eval RX = if(source="netstat", RX, null())
| eval is_threats = if(sourcetype="threats",1,0)
| stats sum(RX) as RX sum(is_threats) as count by splunk_server
| eval ratio = RX/count

[aputz]

That works like a charm. Thank you so much for your assistance!