Hi , I have 2 queries : index="bar_*" sourcetype =foo crm="ser" | dedup uid | stats count as TotalCount and index="bar_*" sourcetype =foo crm="ser" jet="fas" | dedup uid | stats count as TotalFalseCount I need both of these queries merged and then take "TotalCount" and "TotalFalseCount" and get value from these as : ActualPercent= (TotalFalseCount/TotalCount)*100. I created one query as below: index="bar_*" sourcetype =foo crm="ser" | dedup uid | stats count as TotalCount by zerocode SubType | appendcols [searchindex="bar_*" sourcetype =foo crm="ser" jet="fas" | dedup uid | stats count as TotalFalseCount by zerocode SubType] | eval Percent=(TotalFalseCount/TotalCount)*100 | stats count by zerocode SubType Percent but the value of "Percent" is completely wrong, can anybody help to know how can I get proper value of "Percent" in above case ?
... View more