All Apps and Add-ons

How to grab two different numbers using the rest command in the search app

coleman07
Path Finder

I am creating a dashboard to show the % of the license used for the current day. I want to grab the license quota info from the /services/licenser/stacks endpoint and the license usage info from the /services/licenser/pool endpoint then compute the percentage of license used.

I know in the search app, I can do the following:

|rest /services/licenser/pools |search stack_id=download-trial |eval usage=used_bytes | fields usage

and could do the same for the quota:

|rest /services/licenser/stacks | search type=download-trial |  eval lic_quota=quota | fields lic_quota

How would I combine these two to be able to compute usage/lic_quota?

0 Karma

yannK
Splunk Employee
Splunk Employee

Use a main search, and use appendcols the result of the second sub search.

search1 | appendcols [ search2 ] | eval mycalculation

see http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/Appendcols

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...