I have two searches. One search returns a field (using stats count) representing the number of users logging into a website. The other search returns a field (also using stats count) representing the number of users who have tried to reset their password. If there are more password resets than normal logins, this usually indicates an attacker is trying to mine data from our password-reset function.
What I'd like is a search with a field representing the ratio of the two other counts.