I have 2 search results and I like to calculate them.
first is:
host=Marketing-test1 source="/home/splunker/client_mailInfo.csv" E_mail="*"| dedup E_mail | stats count as "Total A"
second one is:
host=Marketing-test1 source=/home/splunker/client_mailInfo.csv E_mail="*"| dedup E_mail | table E_mail, Company, department, Client | fillnull value=DB | sort 0 E_mail | join E_mail [search host=Marketing-test1 NOT source=/home/splunker/client_mailInfo.csv | table E_mail] | stats count as "Total B"
Finally, I would like to get the result, newvalue= "Total B"/"Total A" * 100
I tried OR, appendcols to get the result I want, but it did not go well.
Could anyone help me to solve the problem?
Thank you in advance.
... View more