https://community.splunk.com/t5/Other-Usage/How-to-use-a-result-from-one-query-in-the-calculation-of-another/m-p/632102#M8 <P>Thanks for the reply. I do prefer your appendcols to the join I was using, but I was more after saving the value of activeStorageLicenseGB as something I can use in calculations rather than populating a new column. I'm new to Splunk though, so I may well be thinking about this all wrong.</P> Thu, 23 Feb 2023 23:45:15 GMT cactus 2023-02-23T23:45:15Z https://community.splunk.com/t5/Other-Usage/How-to-use-a-result-from-one-query-in-the-calculation-of-another/m-p/631951#M6 <P>I've got the following to calculate our quota:<BR /><BR />index=summary source="splunk-storage-summary"| stats latest(activeStorageLicenseGB)</P> <P>and the following to give a list of how much is in each of our indexes:<BR /><BR /></P> <P>&nbsp;</P> <LI-CODE lang="markup">index=summary source="splunk-storage-detail" |stats latest(rawSizeGBCustomer) as "size" by idxName |sort -size |fields idxName size</LI-CODE> <P>&nbsp;</P> <P>What I'd like to do is display 'size' in the second query as a percentage of our quota using the results of the first query. I can do it if I use a join and then eval, but is there a way to store the results of that first query in a variable I can then use in the second query?&nbsp;</P> Fri, 24 Feb 2023 04:46:54 GMT https://community.splunk.com/t5/Other-Usage/How-to-use-a-result-from-one-query-in-the-calculation-of-another/m-p/631951#M6 cactus 2023-02-24T04:46:54Z https://community.splunk.com/t5/Other-Usage/How-to-use-a-result-from-one-query-in-the-calculation-of-another/m-p/631998#M7 <P>Try something like this</P><LI-CODE lang="markup">index=summary source="splunk-storage-detail" |stats latest(rawSizeGBCustomer) as "size" by idxName |sort -size |fields idxName size | appendcols [search index=summary source="splunk-storage-summary"| stats latest(activeStorageLicenseGB) as activeStorageLicenseGB] | eventstats values(activeStorageLicenseGB) as activeStorageLicenseGB</LI-CODE> Thu, 23 Feb 2023 11:10:13 GMT https://community.splunk.com/t5/Other-Usage/How-to-use-a-result-from-one-query-in-the-calculation-of-another/m-p/631998#M7 ITWhisperer 2023-02-23T11:10:13Z https://community.splunk.com/t5/Other-Usage/How-to-use-a-result-from-one-query-in-the-calculation-of-another/m-p/632102#M8 <P>Thanks for the reply. I do prefer your appendcols to the join I was using, but I was more after saving the value of activeStorageLicenseGB as something I can use in calculations rather than populating a new column. I'm new to Splunk though, so I may well be thinking about this all wrong.</P> Thu, 23 Feb 2023 23:45:15 GMT https://community.splunk.com/t5/Other-Usage/How-to-use-a-result-from-one-query-in-the-calculation-of-another/m-p/632102#M8 cactus 2023-02-23T23:45:15Z