Joining two queries and getting a percentage

[paul_1994]

I have two queries that I am running and I want to take the results / Count of these queries and divide them. I have seen several variances but I am still having issues trying to get my search correct.

Here is an example of my queries:

index=norlogs sourcetype="devicelog" category="NSException, on wi-fi:"

index=norlogs sourcetype="devicelog" category="FinishLaunching"

I would like to divide the first query by the last query and display a percentage. What would be the best way to accomplish this.

This is working but I am not getting percentages

index=norlogs sourcetype="devicelog" category="NSException"| stats count as TotalA | appendcols [search index=norlogs sourcetype="devicelog" category="FinishLaunching" | stats count as TotalB] | eval Total=TotalB/TotalA

[dwaddle]

Another working solution --

index=norlogs sourcetype=devicelog category="NSException" OR category="FinishLaunching" 
| stats count by sourcetype,category
| xyseries sourcetype, category, count
| eval pct=NSException / FinishLaunching

[paul_1994]

For some reason I could not get this working for me..

Are these the categories? eval pct=NSException / FinishLaunching

Also if my categories are more like this " NSexception 222: helpme" will the above still work?

Thanks!

[emiller42 · Accepted solution]

Try something like this:

index="norlogs" sourcetype="devicelog" category="NSException" OR category="FinishLaunching" | eval A=if(category=="NSException", 1, 0) | eval B=if(category=="FinishLaunching", 1, 0) | stats sum(A) as TotalA sum(B) as TotalB | eval pct=TotalB/TotalA

[paul_1994]

Yay.. thanks I was able to use this solution.

[dwaddle]

(yay IRC!)