I can't tell from the counter names what the difference is between them, so my formula may be off, but I got something like the following to work: index=perfmon counter="Data File Size" | stats avg(Value) as Avg1 by host | join host [search index=perfmon counter="Data File Space Used" | stats avg(Value) as Avg2 by host] | eval Ratio=Avg1/Avg2 | fields host,Ratio I feel like there should be a solution that doesn't run a join, but if your data isn't too extensive this might work. Let me know if that helps. http://docs.splunk.com/Documentation/Splunk/4.3.1/SearchReference/Eval ... View more

hi.. can u just help me out of this.. iam unable to understand that answer. ... View more

Field names are case-sensitive so the field name you gave does not exist; try this: index=os sourcetype=vmstat memFreeMB< 200 ... View more