What is the wrong in this sub search ?
Individually both are working fine.
eventtype="et_system_metrics" Stage=A* AND JOBSTATUS=FINISHED | stats count as numFinish | eval percentage=(numJobs/numFinish)*100 | search [search eventtype="et_system_metrics" Stage=A* AND JOBSTATUS=PENDING | stats count as numPending | rename numPending as numJobs]
eventtype="et_system_metrics" Stage=A* AND JOBSTATUS=FINISHED | stats count as numFinish
Result is 867
eventtype="et_system_metrics" Stage=A* AND JOBSTATUS=PENDING | stats count as numPending
Result is 252
I think you are looking to do this:
eventtype="et_system_metrics" Stage=A* | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100
I don't think the subsearch command is the correct approach in this case.
I think you are looking to do this:
eventtype="et_system_metrics" Stage=A* | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100
I don't think the subsearch command is the correct approach in this case.
brilliant 🙂
Sorry for wrong result - I edited my question
I am calculating the percentage of completion
numFinish is total job
numPending is pending job
Tell us more about what the desired results are. It seems your subsearch would emit something like "numJobs=867" as a filtering expression? What's the idea there?