Appending a result from a search to the result of another search


I have two indexes.
One with data from our Windows servers and another with information from our CMDB.

I want to make a count of servers that have send data to Elastic within the last 24 hours from the Windows index and divide that count with a count of servers in the CMDB index

Something like ((Count of active servers in Windows index / Count of Servers from CMDB) * 100) = “% of know servers that did send data”

I haven’t found any way to do it in Kibana, but being new to Elastic there might be other ways to this.

Best regards
Per Bejder

You can create an index pattern which includes both indices (windows-data,cmdb-data), then create a visualization which filters on the _index field). You can calculate the ratio using Lens formula: Create visualizations with Lens | Kibana Guide [7.16] | Elastic

unique_count(, kql="_index:windows-data")/unique_count(, kql="_index:cmdb-data")

Thanks - I will test that

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.