Splunk Search

Is it possible to run a subsearch within a stats function?

ethanrulez80
New Member

Hi would like to know is there a way to do queries like,

search * | stats values(field1) , values(subquery[field1])  
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can do this:

| stats count | eval foo = "bar" | stats values(count), [stats count as search | eval search = "values(foo)"]

Essentially, the second function and/or field name are evaluated and returned by the subsearch. Adding the values() within the subsearch seems to be necessary to not run into any errors, at least based on my quick testing.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Subsearches are not supported within stats based evals.

MuS
SplunkTrust
SplunkTrust

In addition, read https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo... and watch the March 2016 virtual.conf talk from http://wiki.splunk.com/Virtual_.conf for more info how this can be done without subsearches 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...