I have 2 searches
index=test field1=abc field2=xyc | stats dc(field3) as Devices
and
index=test field1=abc field2=xyc (field6=1111 OR field6=2222) | stats dc(field4) as Connections
I'm trying to take the number from the first search and the number from the second search, which is more filtered, and get an average, specifically an average of the specific connections per device. The device may not have the specific connections, but I need an average even on devices that may not have that specific connection.
I have tried using something like return , but when I combine it, it doesn't seem to like to return anything or use it in an eval like if I do | eval Average=Connections/Devices
Is there any way to combine these 2 into one search and get the values I need?
... View more