https://community.splunk.com/t5/Knowledge-Management/How-to-store-a-value-in-splunk-and-use-the-value-in-other-search/m-p/468539#M4135 <P>in this code i need to store Energ1 with numerical value and the energy1 with the string values and use these values in the last search is it possible to do </P> <P>index=coemission |search household_id="1"| stats sum(energy_consumed_kwh_per_day) as Energ|eval Energ1=Energ</P> <P>|append [ search index=coemission|search household_id ="1"|stats values(energy_provider) as energy|eval energy1=energy]</P> <P>|append [search sourcetype="energyscore"|search energy_provider=energy|stats sum(nuclear) as nuclear,sum(lignite) as lignite,sum(hardcoal) as hardcoal,sum(natural gas) as naturalgas,sum(renewables) as renewables,sum(others) as others </P> <P>|eval nuclear1=nuclear*Energ1|eval lignite1=lignite*Energ1|eval hardcoal1=hardcoal*Energ1|eval naturalgas1=naturalgas*Energ1|eval renewables1=renewables*Energ1|eval others=others*Energ1|fields - nuclear,lignite,hardcoal,naturalgas,renewables,others]</P> Wed, 30 Sep 2020 03:25:19 GMT raghav4a1 2020-09-30T03:25:19Z https://community.splunk.com/t5/Knowledge-Management/How-to-store-a-value-in-splunk-and-use-the-value-in-other-search/m-p/468539#M4135 <P>in this code i need to store Energ1 with numerical value and the energy1 with the string values and use these values in the last search is it possible to do </P> <P>index=coemission |search household_id="1"| stats sum(energy_consumed_kwh_per_day) as Energ|eval Energ1=Energ</P> <P>|append [ search index=coemission|search household_id ="1"|stats values(energy_provider) as energy|eval energy1=energy]</P> <P>|append [search sourcetype="energyscore"|search energy_provider=energy|stats sum(nuclear) as nuclear,sum(lignite) as lignite,sum(hardcoal) as hardcoal,sum(natural gas) as naturalgas,sum(renewables) as renewables,sum(others) as others </P> <P>|eval nuclear1=nuclear*Energ1|eval lignite1=lignite*Energ1|eval hardcoal1=hardcoal*Energ1|eval naturalgas1=naturalgas*Energ1|eval renewables1=renewables*Energ1|eval others=others*Energ1|fields - nuclear,lignite,hardcoal,naturalgas,renewables,others]</P> Wed, 30 Sep 2020 03:25:19 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-store-a-value-in-splunk-and-use-the-value-in-other-search/m-p/468539#M4135 raghav4a1 2020-09-30T03:25:19Z https://community.splunk.com/t5/Knowledge-Management/How-to-store-a-value-in-splunk-and-use-the-value-in-other-search/m-p/468540#M4136 <P>Like this:</P> <PRE><CODE>index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="energyscore" AND energy_provider="energy" |stats sum(nuclear) AS nuclear sum(lignite) AS lignite sum(hardcoal) AS hardcoal sum(natural gas) AS naturalgas sum(renewables) AS renewables,sum(others) AS others |foreach nuclear lignite hardcoal naturalgas renewables others [ eval &lt;&lt;FIELD&gt;&gt;1 = &lt;&lt;FIELD&gt;&gt; * [search index=coemission AND household_id="1" | stats sum(energy_consumed_kwh_per_day) AS Energ | return $Energ ] | fields - &lt;&lt;FIELD&gt;&gt; ] </CODE></PRE> Fri, 20 Dec 2019 10:35:15 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-store-a-value-in-splunk-and-use-the-value-in-other-search/m-p/468540#M4136 woodcock 2019-12-20T10:35:15Z