Perform calculation based on 2 stats count result

[krusovice]

Hello,

I've a requirement to perform the following calculation in percentage.

First query is as below and single value result is 50

    index=* 
    | rex field=_raw "Product ABC.*client\=(?<client>[\w+]+)" 
    | stats count(client) as Count

Then I've another query and single value result is 10:

index=* 
| rex field=_raw "Broken Product.*productid\=(?<productid>[\w+]+)" 
| stats count(productid)

I need to perform the calculation based on the result of above 2 queries. The calculation formula should be 10/50 = 20%. How can I achieve it to come out with 20% as the output of the calculation in Splunk?

Thanks.

[493669 · Accepted solution]

try this:

 index=*|rex field=_raw "Product ABC.*client\=(?<client>[\w+]+)" 
| rex field=_raw "Broken Product.*productid\=(?<productid>[\w+]+)" 
| stats count(client) as clientcount , count(productid) as productcount
|eval percentage=((productcount/clientcount)*100)."%"

[krusovice]

Hi @493669,

It's work! Thank you. Can you update as answer so that I can accept it officially?