I've got the following to calculate our quota:
index=summary source="splunk-storage-summary"| stats latest(activeStorageLicenseGB)
and the following to give a list of how much is in each of our indexes:
index=summary source="splunk-storage-detail"
|stats
latest(rawSizeGBCustomer) as "size"
by idxName
|sort -size
|fields idxName size
What I'd like to do is display 'size' in the second query as a percentage of our quota using the results of the first query. I can do it if I use a join and then eval, but is there a way to store the results of that first query in a variable I can then use in the second query?
Try something like this
index=summary source="splunk-storage-detail"
|stats
latest(rawSizeGBCustomer) as "size"
by idxName
|sort -size
|fields idxName size
| appendcols
[search index=summary source="splunk-storage-summary"| stats latest(activeStorageLicenseGB) as activeStorageLicenseGB]
| eventstats values(activeStorageLicenseGB) as activeStorageLicenseGB
Try something like this
index=summary source="splunk-storage-detail"
|stats
latest(rawSizeGBCustomer) as "size"
by idxName
|sort -size
|fields idxName size
| appendcols
[search index=summary source="splunk-storage-summary"| stats latest(activeStorageLicenseGB) as activeStorageLicenseGB]
| eventstats values(activeStorageLicenseGB) as activeStorageLicenseGB
Thanks for the reply. I do prefer your appendcols to the join I was using, but I was more after saving the value of activeStorageLicenseGB as something I can use in calculations rather than populating a new column. I'm new to Splunk though, so I may well be thinking about this all wrong.