https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-to-find-percentage-and-combine-with-a-stats/m-p/193864#M55873 <P>I believe i'm a bit closer here </P> <P>index=licenselimit earliest=-48h@d | where LIC_SOFT_LIMIT != "" | table LIC_SOFT_LIMIT | append [search index=licenselimit sourcetype=MachineTotals earliest=-48h@d |stats sum(linecount) AS Number_Of_Encrypted_Machines] | eval percentage=(Number_Of_Encrypted_Machines/LIC_SOFT_LIMIT)*100</P> <P>When I run this command it just shows the two fields Number_Of_Encrypted_Machines and LIC_SOFT_LIMIT in a table. Can anyone else how I can make my eval work so I can divide Number Of Encrypted Machines by LIC_SFOT_LIMIT?</P> Mon, 28 Sep 2020 18:04:51 GMT akelly4 2020-09-28T18:04:51Z https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-to-find-percentage-and-combine-with-a-stats/m-p/193863#M55872 <P>I'm trying to setup an alert where if x/y &lt;=x% then it sends an alert out.</P> <P>To do this i'm trying to pull numbers from two separate searches to divide them to get the percentage. But i'm having trouble figuring out what commands to use to do this.</P> <P>1st search - This is the total number of machine that exist<BR /> index=totalmachines sourcetype=Machines earliest=-48h@d |stats sum(linecount) AS Number_Of__Machines</P> <P>2nd search - This is the limit of machines we can reach. I want to use the EVAL command to be able to see when I come close to this limit.<BR /> index=licenselimit sourcetype=LicenseLimitforMachines earliest=-48h@d | rename LIC_SOFT_LIMIT AS License_Limit | table License_Limit</P> <P>I have the numbers I just need to figure out how to combine those searches and run the eval command to get a percentage.</P> Mon, 28 Sep 2020 18:04:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-to-find-percentage-and-combine-with-a-stats/m-p/193863#M55872 akelly4 2020-09-28T18:04:46Z https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-to-find-percentage-and-combine-with-a-stats/m-p/193864#M55873 <P>I believe i'm a bit closer here </P> <P>index=licenselimit earliest=-48h@d | where LIC_SOFT_LIMIT != "" | table LIC_SOFT_LIMIT | append [search index=licenselimit sourcetype=MachineTotals earliest=-48h@d |stats sum(linecount) AS Number_Of_Encrypted_Machines] | eval percentage=(Number_Of_Encrypted_Machines/LIC_SOFT_LIMIT)*100</P> <P>When I run this command it just shows the two fields Number_Of_Encrypted_Machines and LIC_SOFT_LIMIT in a table. Can anyone else how I can make my eval work so I can divide Number Of Encrypted Machines by LIC_SFOT_LIMIT?</P> Mon, 28 Sep 2020 18:04:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-to-find-percentage-and-combine-with-a-stats/m-p/193864#M55873 akelly4 2020-09-28T18:04:51Z https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-to-find-percentage-and-combine-with-a-stats/m-p/193865#M55874 <P>If you're just getting one row from licenselimit search as well (you're getting one row from totalmachines search) then try this</P> <PRE><CODE>index=licenselimit sourcetype=LicenseLimitforMachines earliest=-48h@d | rename LIC_SOFT_LIMIT AS License_Limit | table License_Limit | appendcols [search index=totalmachines sourcetype=Machines earliest=-48h@d |stats sum(linecount) AS Number_Of__Machines] | eval percentage=(Number_Of_Encrypted_Machines/LIC_SOFT_LIMIT)*100 </CODE></PRE> Tue, 04 Nov 2014 21:41:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-to-find-percentage-and-combine-with-a-stats/m-p/193865#M55874 somesoni2 2014-11-04T21:41:18Z https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-to-find-percentage-and-combine-with-a-stats/m-p/193866#M55875 <P>I tried this but it still returns 2 rows with each of those fields. From what I can tell it's not doing that calculation.</P> Wed, 05 Nov 2014 20:10:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-to-find-percentage-and-combine-with-a-stats/m-p/193866#M55875 akelly4 2014-11-05T20:10:49Z