Hello
I would like to know if its possible to reuse the result of the field Total in another search?
| stats dc(titi) as Total
Thanks
This sort of thing can work so long as the result you want is in the first row of the results. It also means that the subsequent search must run after this search has completed.
It depends what you mean by this - please give a more precise explanation of what you are trying to achieve
In fact, I need to calculate in the second search a percentage from the Total field of the first search
something like this : eval perc=(Total2 / Total * 100)
Total2 is the total for the second search
| stats dc(tutu) as Total2
I know it's possible to append these 2 search but my need is just to be able to reuse the field Total from the first search in the second search
It depends on your searches and whether you can correlate total2 to the relevant events in the pipeline from search 1 - don't forget that splunk works on a pipeline of events and you essentially have to arrange for your data to be in the pipeline at the right time in order to process it.
ok I understand but the aim of my question is to find a solution for using in a search the token of another search
it means that do we have to use something like this or something else?
<done>
<condition>
<set token="ProcessSup80">$result.ProcessSup80$</set>
<set token="NbIndHost">$result.NbIndHost$</set>
</condition>
</done>
This sort of thing can work so long as the result you want is in the first row of the results. It also means that the subsequent search must run after this search has completed.