Hi, I'm using the below query in order retrieve average and standard deviation for the respective days (mon,tue,wed, etc. ) for each warehouse for the last 90 days and i want to use the output values in other calculation in order to retrieve the limits. Could you please help how i can achieve this ? How are the values retrieved from stats command by clause are stored internally and how i can assign them to new variable matrix etc ? Search Query: index="orderstowh" | where in (WH,1,2,3,4,5,6,7,8,9) | timechart span=1d count as "Total" by WH | untable _time WH Total | eval dayofweek=strftime(_time,"%w") | where dayofweek in (1,2,3,4,5) | stats avg(Total) as avg stdev(Total) as stdev by WH,dayofweek ........................... | eval lowerBound[WH,dayofweek]=(avg[WH,dayofweek]-(stdev[WH,dayofweek]) ) | eval upperBound[WH,dayofweek]=(avg[WH,dayofweek]+(stdev[WH,dayofweek]) ) Thanks in advance!! ... View more

How do I create a report that can run automatically only when the indexer performs indexing after receiving an input file from forwarder instead of the scheduling with given fixed time ? I have a requirement to create a report to consider the actual volumes which acquires data from an indexed file that is received forwarded by the forwarder (not frequently) but when received and indexed the input file the report should automatically run with out depending on the scheduler. May be for example if the file has to be generally received daily once but if the file has not arrived but it arrived in delay (no fixed delay) or arrived next day how can i manage this kind of requirement in splunk ? Could you please help me ? ... View more