How to sum same field twice

[TylerJVitale]

I want to be able to sum the same field in order to create 2 different fields so that I can compare the Volume by application to the total volume. Right now this is the structure of my search:

| stats sum(VOLUME) as VOLUME, count(USERNAME_O) as AFFECTED_USERS by APPLICATION | 
join [ search |  stats sum(VOLUME) as TOTAL_VOLUME | where TOTAL_VOLUME > 1 |  head 1 ]

Is there a more efficient way I can do this so that I don't have to use the "join" part and go through the whole index twice?

[jnudell_2 · Accepted solution]

Hi @TylerJVitale ,

This sounds like a good place to use eventstats.

| stats sum(VOLUME) as VOLUME, count(USERNAME_O) as AFFECTED_USERS by APPLICATION
| eventstats sum(VOLUME) as TOTAL_VOLUME