What's wrong in this sub search ?

[jangid]

What is the wrong in this sub search ?
Individually both are working fine.

eventtype="et_system_metrics" Stage=A* AND JOBSTATUS=FINISHED | stats count as numFinish | eval percentage=(numJobs/numFinish)*100 | search [search eventtype="et_system_metrics" Stage=A* AND JOBSTATUS=PENDING | stats count as numPending | rename numPending as numJobs]

eventtype="et_system_metrics" Stage=A* AND JOBSTATUS=FINISHED | stats count as numFinish

Result is 867

eventtype="et_system_metrics" Stage=A* AND JOBSTATUS=PENDING | stats count as numPending

Result is 252

[sdaniels · Accepted solution]

I think you are looking to do this:

eventtype="et_system_metrics" Stage=A*  | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100

I don't think the subsearch command is the correct approach in this case.

[jangid]

brilliant 🙂

[jangid]

Sorry for wrong result - I edited my question

I am calculating the percentage of completion
numFinish is total job
numPending is pending job

[Ayn]

Tell us more about what the desired results are. It seems your subsearch would emit something like "numJobs=867" as a filtering expression? What's the idea there?