How do I create splunk query to get the total percentage of the two results

[rodrigrc]

I'm new to splunk and need further guidance to be able to accomplish my dashboard for Pi-Hole:

Could some expert guide me how?

Queries Blocked
tag=dns tag=network tag=resolution query_type=blocked |stats count

Total Queries
sourcetype="pihole:log*" tag=dns tag=network tag=resolution query |stats count

How do I create splunk query to get the total percentage of the two results
Queries Blocked/Total queries x 100 = ?

I just need the exact value so i can just simply copy and paste the good answer here to my splunk field.

Your input is highly appreciated.

[nickhills]

Try this:

sourcetype="pihole:log*"  tag=dns tag=network tag=resolution 
|stats count as total, count(eval(query_type="blocked") as blocked 
|eval percent=round((blocked/total)* 100,1)

[rodrigrc]

if i put this search query, i get the correct total no output, but with "zero" blocked output.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
sourcetype="pihole:log" tag=dns tag=network tag=resolution message_type="Query"
|stats count as total, count(eval(query_type="Blocked")) as blocked
|eval percent=round((blocked/total)* 100,1)

total blocked percent
20433 0 0.0
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

And below results shows the correct no. of blocked outputs, but too many entries outputs
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
sourcetype="pihole:log" tag=dns tag=network tag=resolution
|stats count as total, count(eval(query_type="Blocked")) as blocked
|eval percent=round((blocked/total)* 100,1)

total blocked percent
91921 3683 4.0
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

[to4kawa]

message_type="Query" does not have query_type="Blocked"
and many message_type have query_type="Blocked"
you only know your logs. good luck.