https://community.splunk.com/t5/Splunk-Search/How-to-use-the-stored-results-in-variables-after-stats-command/m-p/470579#M132380 <P>Hi,</P> <P>I'm using the below query in order retrieve average and standard deviation for the respective days (mon,tue,wed, etc. ) for each warehouse for the last 90 days and i want to use the output values in other calculation in order to retrieve the limits. </P> <P>Could you please help how i can achieve this ? How are the values retrieved from stats command by clause are stored internally and how i can assign them to new variable matrix etc ? </P> <P>Search Query:<BR /> index="orderstowh" <BR /> | where in (WH,1,2,3,4,5,6,7,8,9) <BR /> | timechart span=1d count as "Total" by WH<BR /> | untable _time WH Total<BR /> | eval dayofweek=strftime(_time,"%w") <BR /> | where dayofweek in (1,2,3,4,5)<BR /> | stats avg(Total) as avg stdev(Total) as stdev by WH,dayofweek<BR /> ...........................<BR /> | eval lowerBound[WH,dayofweek]=(avg[WH,dayofweek]-(stdev[WH,dayofweek]) )<BR /> | eval upperBound[WH,dayofweek]=(avg[WH,dayofweek]+(stdev[WH,dayofweek]) )</P> <P>Thanks in advance!!</P> Wed, 30 Sep 2020 02:02:39 GMT vinaybandaru 2020-09-30T02:02:39Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-stored-results-in-variables-after-stats-command/m-p/470579#M132380 <P>Hi,</P> <P>I'm using the below query in order retrieve average and standard deviation for the respective days (mon,tue,wed, etc. ) for each warehouse for the last 90 days and i want to use the output values in other calculation in order to retrieve the limits. </P> <P>Could you please help how i can achieve this ? How are the values retrieved from stats command by clause are stored internally and how i can assign them to new variable matrix etc ? </P> <P>Search Query:<BR /> index="orderstowh" <BR /> | where in (WH,1,2,3,4,5,6,7,8,9) <BR /> | timechart span=1d count as "Total" by WH<BR /> | untable _time WH Total<BR /> | eval dayofweek=strftime(_time,"%w") <BR /> | where dayofweek in (1,2,3,4,5)<BR /> | stats avg(Total) as avg stdev(Total) as stdev by WH,dayofweek<BR /> ...........................<BR /> | eval lowerBound[WH,dayofweek]=(avg[WH,dayofweek]-(stdev[WH,dayofweek]) )<BR /> | eval upperBound[WH,dayofweek]=(avg[WH,dayofweek]+(stdev[WH,dayofweek]) )</P> <P>Thanks in advance!!</P> Wed, 30 Sep 2020 02:02:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-stored-results-in-variables-after-stats-command/m-p/470579#M132380 vinaybandaru 2020-09-30T02:02:39Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-stored-results-in-variables-after-stats-command/m-p/470580#M132381 <P>The results of the <CODE>stats</CODE> command are stored in fields named using the words that follow <CODE>as</CODE> and <CODE>by</CODE>. In your example, the results are in 'avg', 'stdev', 'WH', and 'dayofweek'. Each field is separate - there are no tuples in Splunk. Display the output from <CODE>stats</CODE> and you'll see there's a different row for each combination of 'WH' and 'dayofweek' so any <CODE>evals</CODE> will be calculated using those separate results. Therefore, you can use <CODE>| eval lowerBound=avg-stdev, upperBound=avg+stdev</CODE>.</P> Tue, 03 Sep 2019 13:03:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-stored-results-in-variables-after-stats-command/m-p/470580#M132381 richgalloway 2019-09-03T13:03:37Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-stored-results-in-variables-after-stats-command/m-p/470581#M132382 <P>Hi,</P> <P>Thank you it works !! </P> <P>index="orderstowh" <BR /> | where in (WH,1,2,3,4,5,6,7,8,9) <BR /> | timechart span=1d count as "Total" by WH<BR /> | untable _time WH Total<BR /> | eval dayofweek=strftime(_time,"%w") <BR /> | where dayofweek in (1,2,3,4,5)<BR /> | stats avg(Total) as avg stdev(Total) as stdev by WH,dayofweek<BR /> | eval lowerBound=(avg-(stdev) )<BR /> | eval upperBound=(avg+(stdev) )</P> Wed, 30 Sep 2020 02:03:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-stored-results-in-variables-after-stats-command/m-p/470581#M132382 vinaybandaru 2020-09-30T02:03:56Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-stored-results-in-variables-after-stats-command/m-p/505027#M141055 <P>I'm not sure that works. In my case it doesn't show anything and I'm using the same as you.</P><LI-CODE lang="markup">index=blueprism sourcetype=BP_Parkour_Status source=TABLA::RPA_BLUEPRISM | bin span=1d _time | stats count as total by _time | where tipoexcep="Business Exception" | stats count as totalDetalle by detalexcep _time | eval porc=totalDetalle/total*100 | table totalDetalle total porc</LI-CODE> Thu, 18 Jun 2020 16:10:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-stored-results-in-variables-after-stats-command/m-p/505027#M141055 rmanrique 2020-06-18T16:10:01Z