Best way to use multipe searchs to get shared result that can be used for percentage.

[cbright]

Trying to use multiple searches to get a percentage of total servers to be restored and total currently restored but can not get all values to be shared.

I know it is the construct or the searches but can not figure out the issue, need some help to get the format right.

Here is the search that uses indexed data and lookup files:

|inputlookup DRServerList.csv
|search PhysicalVirtual=P (Platform!=IP* AND Platform!=link*)
|stats count as allPhys
|append [search index=main sourcetype=ssdr Result=good
| rex field=_raw "^(?:[^ \n]* ){6}(?\w+):\s+(?P.)(?:[^ \n] ){2}(?P\w+)\s+::\s+(?P\w+)(?:[^ \n]* ).::\s(?P.+)"
|dedup Node

| eval HostName=lower(Node)
| join [inputlookup DRServerList.csv
|search PhysicalVirtual=P (Platform!=IP AND Platform!=link*)
|eval HostName=lower(HostName)]
| stats count(eval(HostName==lower(HostName))) AS restore]
| eval mypercent=(restore/allPhys*100)
|table allPhys restore mypercent

[jdonn_splunk]

Glad to see you fixed it on your own. I just wanted to comment so that it did not appear not to be resolved / answered.

[cbright]

Figured it out needed a another join where I had the append in the search.