I am trying to pass the numeric result of a subsearch to the head command with no success, can anyone see what I am doing wrong?
The following query returns a count of 3
index=starx error | fieldformat count=count/2 | stats count
I want to use that query as a subsearch result for the head command like this
index=starx error | head [ search index=starx error | fieldformat count=count/2 | stats count ]
But get no result found
Hi proylea,
if you want to pass a value to the head
command you must return only a value form the subsearch, but you're currently returning count=somenumber
. Do get back only a value from the subsearch run this run everywhere search
index=_internal error | head [ search index=_internal error | stats count | rename count AS search ]
This will rename the count
field to a search
field, which will just come back as a value. This way head
can use it.
Hope this helps ...
cheers, MuS
If you want to avoid using a subsearch altogether you could do something like this:
index=starx error | streamstats count as total_results | eventstats p50(count) as average | eval keep=count-average | search keep>0
This avoids any limitations in the subsearch if your index is very large, and saves you from running the index=starx search twice.
Hi proylea,
if you want to pass a value to the head
command you must return only a value form the subsearch, but you're currently returning count=somenumber
. Do get back only a value from the subsearch run this run everywhere search
index=_internal error | head [ search index=_internal error | stats count | rename count AS search ]
This will rename the count
field to a search
field, which will just come back as a value. This way head
can use it.
Hope this helps ...
cheers, MuS
Finally got it!
index=starx error | head [ search index=starx error | stats count | eval total=round(count/2) | rename total AS search ]
Hi MuS
With your query both the base search and the subsearch returns the same count, hence the head value returned is not divided by 2.
Regards
Peter
Sorry my bad, ignore the second example. Look at the provided first example and tweak it to your needs.
Cheers, I still can't work out how to divide the count by 2 to return the result?
Thanks for your help MuS with the rename AS search