Hi, I have 2 queries , let's call them query_a & query_b. query_a - gives me a table containing all the userAgent's that call a specific endpoint of my service, basically this gives me a list of all the clients who are on outdated versions of my app, as those are the only ones calling this deprecated endpoint. So this query gives me a list of all the outdated versions of my app that are still being used. query_b - gives me a table containing all the userAgent's for every endpoint of my service. So this query gives me a list of every versions of my app that is being used. here userAgent is a string like this "app_name/app_version (device_name; device_OS_version)" I am only concerned with the app_version out of this I need to calculate, what percentage of userAgent's given by query_a (clients on outdated app_version) that are part of the results given by query_b (all clients) . I need to do this to figure out how many clients we have using outdated app version. How do I achieve this. query_a is like this: index::apps source="/data/log/company/service/SERVICE-PUBLIC-API-access.log" "GET /service/diners/*/orders"
| rex "diners/(?<dinerId>.*)/orders HTTP/1.1\" (?<responseStatus>\d\d\d) .. ... \"(?<userAgent>.*?)\""
| dedup userAgent
| table userAgent query_b is like this: index::apps source="/data/log/company/service/SERVICE-PUBLIC-API-access.log"
| rex "HTTP/1.1\" (?<responseStatus>\d\d\d) .. ... \"(?<userAgent>.*?)\""
| dedup userAgent
| table userAgent
... View more