I want to be able to sum the same field in order to create 2 different fields so that I can compare the Volume by application to the total volume. Right now this is the structure of my search:
| stats sum(VOLUME) as VOLUME, count(USERNAME_O) as AFFECTED_USERS by APPLICATION |
join [ search | stats sum(VOLUME) as TOTAL_VOLUME | where TOTAL_VOLUME > 1 | head 1 ]
Is there a more efficient way I can do this so that I don't have to use the "join" part and go through the whole index twice?
Hi @TylerJVitale ,
This sounds like a good place to use eventstats.
| stats sum(VOLUME) as VOLUME, count(USERNAME_O) as AFFECTED_USERS by APPLICATION
| eventstats sum(VOLUME) as TOTAL_VOLUME
View solution in original post