https://community.splunk.com/t5/Splunk-Search/How-to-search-result-in-data-and-put-it-in-a-table/m-p/465496#M131153 <P>If this post solved you problem please mark it as an answer. Thanks</P> Thu, 29 Aug 2019 16:22:11 GMT diogofgm 2019-08-29T16:22:11Z https://community.splunk.com/t5/Splunk-Search/How-to-search-result-in-data-and-put-it-in-a-table/m-p/465491#M131148 <P>I need to create a table from the results in the query below. where the utilization is greater than or equal to .7.</P> <PRE><CODE>index=test cluster="*"| bin _time span=1d|eval time=(time)|eventstats sum(dscapacityGB) as capacity sum(dsfreeGB) as free sum(dsgarbageGB) as garbage sum(vmdkallocGB) as vmdkallocated sum(vmdkusedGB) as vmdkused by cluster, _time|eval over_allocated = round((vmdkallocated/free*100),2)|eval utilization= round(((vmdkused+garbage)/capacity),2)|eval capacity = round((capacity),2)|eval free = round((free),2)| eval garbage = round((garbage),2)|eval vmdkallocated = round((vmdkallocated),2)|eval vmdkused = round((vmdkused),2)|dedup _time cluster|where utilization&gt;=.7|table _time cluster capacity free garbage vmdkallocated vmdkused over_allocated utilization </CODE></PRE> <P>Please feel free to rewrite my code, I know its not efficient or pretty. I'm still learning splunk.</P> Wed, 28 Aug 2019 23:04:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-result-in-data-and-put-it-in-a-table/m-p/465491#M131148 codedtech 2019-08-28T23:04:50Z https://community.splunk.com/t5/Splunk-Search/How-to-search-result-in-data-and-put-it-in-a-table/m-p/465492#M131149 <P>what's the problem you're trying to have solve? Isn't this working?</P> Wed, 28 Aug 2019 23:10:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-result-in-data-and-put-it-in-a-table/m-p/465492#M131149 diogofgm 2019-08-28T23:10:26Z https://community.splunk.com/t5/Splunk-Search/How-to-search-result-in-data-and-put-it-in-a-table/m-p/465493#M131150 <P>I for some reason can't get only the values that are above .7 to display in the table, if I run it like this I get over 1000 results. I'm trying to use this to create an alert that will be distributed via email to the rest of the guys I work with. I need to cut that down to only the results that are greater than or equal to .7</P> Wed, 28 Aug 2019 23:47:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-result-in-data-and-put-it-in-a-table/m-p/465493#M131150 codedtech 2019-08-28T23:47:20Z https://community.splunk.com/t5/Splunk-Search/How-to-search-result-in-data-and-put-it-in-a-table/m-p/465494#M131151 <P>try removing the <CODE>|where</CODE>and check the final table for the utilisation values. if all seems ok and you're able to find utilization greater than 0.7 (also try using the 0 before the . ) add the <CODE>|where</CODE> after the <CODE>|table</CODE> . If this still does not work, replace the <CODE>|where</CODE> with <CODE>|search</CODE></P> Thu, 29 Aug 2019 00:04:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-result-in-data-and-put-it-in-a-table/m-p/465494#M131151 diogofgm 2019-08-29T00:04:49Z https://community.splunk.com/t5/Splunk-Search/How-to-search-result-in-data-and-put-it-in-a-table/m-p/465495#M131152 <P>This worked thank you</P> <P>index=test cluster="*"| bin _time span=1d|eval time=(time)|eventstats sum(dscapacityGB) as capacity sum(dsfreeGB) as free sum(dsgarbageGB) as garbage sum(vmdkallocGB) as vmdkallocated sum(vmdkusedGB) as vmdkused by cluster, _time|eval over_allocated = round((vmdkallocated/free),2)|eval utilization= round(((vmdkused+garbage)/capacity),2)|eval capacity = round((capacity),2)|eval free = round((free),2)|<BR /> eval garbage = round((garbage),2)|eval vmdkallocated = round((vmdkallocated),2)|eval vmdkused = round((vmdkused),2)|dedup _time cluster|table _time cluster capacity free garbage vmdkallocated vmdkused over_allocated utilization|where utilization&gt;=0.75|sort -utilization</P> Wed, 30 Sep 2020 01:57:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-result-in-data-and-put-it-in-a-table/m-p/465495#M131152 codedtech 2020-09-30T01:57:33Z https://community.splunk.com/t5/Splunk-Search/How-to-search-result-in-data-and-put-it-in-a-table/m-p/465496#M131153 <P>If this post solved you problem please mark it as an answer. Thanks</P> Thu, 29 Aug 2019 16:22:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-result-in-data-and-put-it-in-a-table/m-p/465496#M131153 diogofgm 2019-08-29T16:22:11Z