Merging Splunk Searches

[memow8]

Hi Pros,

I want to merge results of two queries together and need some help in achieving the best possible way to do it...

index=* sourcetype=* | top sourcetype limit=200
index=* sourcetype=* | stats count(host) by sourcetype

I want to show.... following results...

Sourcetype Hosts(number of hosts contributing to the sourcetype) Count(Event count) Percentage (based on time)

[renjith_nair]

Hi @memow8,

Try this

index="your index"|stats count(host) as no_of_hosts by sourcetype|eventstats sum(no_of_hosts) as total|eval perc=round((no_of_hosts/total)*100,2)|sort -no_of_hosts