Find the percentage between two fields from two sourcetypes

[lehrfeld]

I have two sourcetypes - submitters, and recipient_group. I am looking to find the percentage of submitters that are in the recipient_group. If I have 500 submitters and 1000 recipients, my percentage would be 50%. The following search gives me the dc of users in each sourcetype, but I don't have the Splunk knowledge on how to retain those values so I can perform the math.

sourcetype = submitters OR sourcetype=recipient_group  | eval UserID{sourcetype}=UserID | stats dc(UserIDR*), dc(UserIDS*)

Thanks everyone! Mike

[lehrfeld · Accepted solution]

Figured it out. My issue was using the wildcard '*' in the dc command. When I used the entire name - poof!

sourcetype = submitters OR
sourcetype=recipient_group | eval
UserID{sourcetype}=UserID |stats
dc(eval(UserIDRecipient_Group)) as
USERR, dc(eval(UserIDSubmitters)) as
USERS | eval
percentage=(USERS/USERR*100)

[yannK]

what about starting with something like that, then calculate the ratio.
sourcetype=submitters OR sourcetype=recipient_group | chart dc(UserID) by UserID sourcetype | eval in_both=if(submitters==1 AND recipient_group==1,1,0)

Then do the total and clean, then eval a percentage
... | addcoltotals | WHERE isnull(UserID) | table submitters recipient_group in_both

[lehrfeld]

yannK - Thanks for the response. To keep it simple, both of our sourcetypes only have one type of data in it. So a simple dc(userID) will give use the count needed to calculate the ratio. I just can't find a way to capture those values to do a calculation on them. I will keep tweaking the code and post back soon (hopefully). Mike