Failed eval command from sub search numerical results- Any suggestions?

[Seawheels51]

Hello gurus

I'm trying to return a percentage from the results of sub searches. The value User_count and Device_count are numerical but the eval returns nothing. If I convert either of the values to a number and leave the other named the eval works. Could you offer a suggestion to make this search work please? Thank you!

index="test" earliest=-2d@d latest=-1d@d
| dedup User
| stats count(User) as User_count
| append [search index="test" | stats dc(SerialNumber) as Device_count]
| eval perc=round(User_count/Device_count*100, 2)."%"

[Seawheels51]

Thank you, that achieved the desired results! I appreciate the prompt and accurate response, well done!

[isoutamo · Accepted solution]

Hi

if you are using the same time period for both user and devices you can try this

index="test" earliest=-2d@d latest=-1d@d
| stats dc(User) as User_count dc(SerialNumber) as Device_count
| eval perc=round(User_count/Device_count*100, 2)."%"

In SPL you should almost always replace join, append* with stats. There are lot of presentation what to do it e.g.  https://conf.splunk.com/watch/conf-online.html?search=%22Nick%20Mealy%22#/ are links to Nick's "yearly" conf presentations.

r. Ismo