Other Usage

How to use a result from one query in the calculation of another?

cactus
Engager

I've got the following to calculate our quota:

index=summary source="splunk-storage-summary"| stats latest(activeStorageLicenseGB)

and the following to give a list of how much is in each of our indexes:

 

index=summary source="splunk-storage-detail"
|stats
latest(rawSizeGBCustomer) as "size"
by idxName
|sort -size
|fields idxName size

 

What I'd like to do is display 'size' in the second query as a percentage of our quota using the results of the first query. I can do it if I use a join and then eval, but is there a way to store the results of that first query in a variable I can then use in the second query? 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index=summary source="splunk-storage-detail"
|stats
latest(rawSizeGBCustomer) as "size"
by idxName
|sort -size
|fields idxName size
| appendcols
  [search index=summary source="splunk-storage-summary"| stats latest(activeStorageLicenseGB) as activeStorageLicenseGB]
| eventstats values(activeStorageLicenseGB) as activeStorageLicenseGB

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index=summary source="splunk-storage-detail"
|stats
latest(rawSizeGBCustomer) as "size"
by idxName
|sort -size
|fields idxName size
| appendcols
  [search index=summary source="splunk-storage-summary"| stats latest(activeStorageLicenseGB) as activeStorageLicenseGB]
| eventstats values(activeStorageLicenseGB) as activeStorageLicenseGB
0 Karma

cactus
Engager

Thanks for the reply. I do prefer your appendcols to the join I was using, but I was more after saving the value of activeStorageLicenseGB as something I can use in calculations rather than populating a new column. I'm new to Splunk though, so I may well be thinking about this all wrong.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...