How to reuse a token in another search?

[jip31]

Hello

I would like to know if its possible to reuse the result of the field Total in another search?

| stats dc(titi) as Total

Thanks 

[ITWhisperer]

It depends what you mean by this - please give a more precise explanation of what you are trying to achieve

[jip31]

In fact, I need to calculate in the second search a percentage from the Total field of the first search

something like this : eval perc=(Total2 / Total * 100)

Total2 is the total for the second search

| stats dc(tutu) as Total2

I know it's possible to append these 2 search but my need is just to be able to reuse the field Total from the first search in the second search

[ITWhisperer]

It depends on your searches and whether you can correlate total2 to the relevant events in the pipeline from search 1 - don't forget that splunk works on a pipeline of events and you essentially have to arrange for your data to be in the pipeline at the right time in order to process it.

[jip31]

ok I understand  but the aim of my question is to find a solution for using in a search the token of another search

it means that do we have to use something like this or something else?

           <done>
             <condition>
               <set token="ProcessSup80">$result.ProcessSup80$</set>
               <set token="NbIndHost">$result.NbIndHost$</set>
             </condition>
           </done>

[ITWhisperer · Accepted solution]

This sort of thing can work so long as the result you want is in the first row of the results. It also means that the subsequent search must run after this search has completed.