How to calculate percentage from 2 different searches?

[jip31]

hello

I try to calculate a percentage from 2 searches results
I know how to count results from my first search :

index="x" sourcetype=y source="z" EventCode=6008 

And I know how to count results from my second search

[| inputlookup host.csv ]|

But I dont succeed to calcul a percentage by divising the first search result by the second search result
I would like to do something like this :

eval search 1 = toto
eval search 2 = titi
eval result =( toto/titi)*100

Could you help me please?

[niketn · Accepted solution]

@jip31 please try out the following and confirm.

index="x" sourcetype=y source="z" EventCode=6008 
| stats count as toto
| appendcols 
   [| inputlookup host.csv 
     | stats count as titi]
| eval Perc=round((toto/titi)*100,2)

Following is a run anywhere example based on Splunk's _internal and _audit indexes on similar lines (provided you have access to query these indexes)

| tstats count as "Internal" where index=_internal sourcetype="splunk*" 
| appendcols 
    [| tstats count as "Audit" where index=_audit
        ]
| eval Perc=round((Audit/Internal)*100,2)

[jip31]

thanks you are the best 😉