Appending a result from a search to the result of another search

Elastic Stack Kibana
1

Hi

I have two indexes.
One with data from our Windows servers and another with information from our CMDB.

I want to make a count of servers that have send data to Elastic within the last 24 hours from the Windows index and divide that count with a count of servers in the CMDB index

Something like ((Count of active servers in Windows index / Count of Servers from CMDB) * 100) = “% of know servers that did send data”

I haven’t found any way to do it in Kibana, but being new to Elastic there might be other ways to this.

Best regards
Per Bejder

2

You can create an index pattern which includes both indices (windows-data,cmdb-data), then create a visualization which filters on the _index field). You can calculate the ratio using Lens formula: Create visualizations with Lens | Kibana Guide [7.16] | Elastic

unique_count(server.id, kql="_index:windows-data")/unique_count(server.id, kql="_index:cmdb-data")

3

Thanks - I will test that