Table and Percentage Calculation from Multiple Searches

[splunkbn00bie]

Here is my query - I'm doing two searches that are independent of each other. In both searches, I'm restricting the time to a certain hour and then grouping by day. 

index="first search" | eval date_hour=strftime(_time, "%H") | eval dateday=strftime(_time, "%d") | search date_hour>=10 date_hour<11 | stats count as totalFail by dateday | append [search index="second search" | eval date_hour=strftime(_time, "%H") | search date_hour>=10 date_hour<11 | eval date_day=strftime(_time, "%d") | stats count as totalProcess by date_day | eval failureRate = totalFail/totalProcess] | table dateday, totalFail, totalProcess, failureRate

Trying to achieve  two things here: 1) Getting the data to be outputted "correctly" as a table (ie, data is uniform across rows) and 2) Getting a simple calculation (percentage) to work. 

Right now the table is not formatted correctly (ie, 10 rows, instead of 5) and the percentage calculation doesn't appear to be working. 

Here is the desired output:

Day | Fail | Total | Percentage

10 | 1 | 10 | 10%

11 | 2 | 10 | 20%

12| 0| 10| 0%

[ITWhisperer · Accepted solution]

index="first search" 
| eval date_hour=strftime(_time, "%H") 
| eval dateday=strftime(_time, "%d") 
| search date_hour>=10 date_hour<11 
| stats count as totalFail by dateday 
| appendcols [search index="second search" 
  | eval date_hour=strftime(_time, "%H") 
  | search date_hour>=10 date_hour<11 
  | eval date_day=strftime(_time, "%d") 
  | stats count as totalProcess by date_day ]
| eval failureRate = totalFail/totalProcess 
| table dateday, totalFail, totalProcess, failureRate

[splunkbn00bie]

Thank you, this worked great!