How to use eval to find percentage and combine with a stats search to set up an alert?

[akelly4]

I'm trying to setup an alert where if x/y <=x% then it sends an alert out.

To do this i'm trying to pull numbers from two separate searches to divide them to get the percentage. But i'm having trouble figuring out what commands to use to do this.

1st search - This is the total number of machine that exist
index=totalmachines sourcetype=Machines earliest=-48h@d |stats sum(linecount) AS Number_Of__Machines

2nd search - This is the limit of machines we can reach. I want to use the EVAL command to be able to see when I come close to this limit.
index=licenselimit sourcetype=LicenseLimitforMachines earliest=-48h@d | rename LIC_SOFT_LIMIT AS License_Limit | table License_Limit

I have the numbers I just need to figure out how to combine those searches and run the eval command to get a percentage.

[somesoni2]

If you're just getting one row from licenselimit search as well (you're getting one row from totalmachines search) then try this

index=licenselimit sourcetype=LicenseLimitforMachines earliest=-48h@d | rename LIC_SOFT_LIMIT AS License_Limit | table License_Limit | appendcols [search index=totalmachines sourcetype=Machines earliest=-48h@d |stats sum(linecount) AS Number_Of__Machines] | eval percentage=(Number_Of_Encrypted_Machines/LIC_SOFT_LIMIT)*100

[akelly4]

I tried this but it still returns 2 rows with each of those fields. From what I can tell it's not doing that calculation.

[akelly4]

I believe i'm a bit closer here

index=licenselimit earliest=-48h@d | where LIC_SOFT_LIMIT != "" | table LIC_SOFT_LIMIT | append [search index=licenselimit sourcetype=MachineTotals earliest=-48h@d |stats sum(linecount) AS Number_Of_Encrypted_Machines] | eval percentage=(Number_Of_Encrypted_Machines/LIC_SOFT_LIMIT)*100

When I run this command it just shows the two fields Number_Of_Encrypted_Machines and LIC_SOFT_LIMIT in a table. Can anyone else how I can make my eval work so I can divide Number Of Encrypted Machines by LIC_SFOT_LIMIT?