Help joining the 2 below searches

[tomjb94]

Hi - 

We have a requirement to join the below eval statement searches, would it be possible if someone could assist with the solution please?

eval search 1 = index="wpg" host=*pz-pay* OrderSummary | stats count AS "Total"
eval search 2 = index="wpg" host=*pz-pay* OrderSummary AND "Address is invalid, it might contain a card number") | stats count AS "Failure"
eval result =( search 1/search 2)*100

Thanks,

Tom

[richgalloway]

Try this

(index="wpg" host=*pz-pay*) (OrderSummary OR (OrderSummary AND "Address is invalid, it might contain a card number"))
| eval is_invalid=if(searchmatch("Address is invalid, it might contain a card number"), 1, 0)
| stats count AS "Total", count(eval(is_invalid=1)) as Failure
| eval result = (Failure * 100)/Total

[ITWhisperer]

Try something llke this

index="wpg" host=*pz-pay* OrderSummary
| eventstats count AS "Total"
| search "Address is invalid, it might contain a card number"
| stats count AS "Failure" values(Total) as Total
| eval result = (Total/Failure)*100