I am creating a dashboard to show the % of the license used for the current day. I want to grab the license quota info from the /services/licenser/stacks endpoint and the license usage info from the /services/licenser/pool endpoint then compute the percentage of license used.
I know in the search app, I can do the following:
|rest /services/licenser/pools |search stack_id=download-trial |eval usage=used_bytes | fields usage
and could do the same for the quota:
|rest /services/licenser/stacks | search type=download-trial | eval lic_quota=quota | fields lic_quota
How would I combine these two to be able to compute usage/lic_quota?
Use a main search, and use appendcols the result of the second sub search.
search1 | appendcols [ search2 ] | eval mycalculation
see http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/Appendcols