Splunk Enterprise

How to reuse a token in another search?

jip31
Motivator

Hello

I would like to know if its possible to reuse the result of the field Total in another search?

| stats dc(titi) as Total

Thanks 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

This sort of thing can work so long as the result you want is in the first row of the results. It also means that the subsequent search must run after this search has completed.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends what you mean by this - please give a more precise explanation of what you are trying to achieve

0 Karma

jip31
Motivator

In fact, I need to calculate in the second search a percentage from the Total field of the first search

something like this : eval perc=(Total2 / Total * 100)

Total2 is the total for the second search

| stats dc(tutu) as Total2

I know it's possible to append these 2 search but my need is just to be able to reuse the field Total from the first search in the second search

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on your searches and whether you can correlate total2 to the relevant events in the pipeline from search 1 - don't forget that splunk works on a pipeline of events and you essentially have to arrange for your data to be in the pipeline at the right time in order to process it.

0 Karma

jip31
Motivator

ok I understand  but the aim of my question is to find a solution for using in a search the token of another search

it means that do we have to use something like this or something else?

           <done>
             <condition>
               <set token="ProcessSup80">$result.ProcessSup80$</set>
               <set token="NbIndHost">$result.NbIndHost$</set>
             </condition>
           </done>
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This sort of thing can work so long as the result you want is in the first row of the results. It also means that the subsequent search must run after this search has completed.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...