https://community.splunk.com/t5/Splunk-Search/get-count-of-subsearch-and-main-search/m-p/497979#M138722 <P>Iam trying to get a inner join result which looks some thing like if there are 100 unique fields from subsearch, I want to confirm if each field is present in the main search and get the count if presents. get count of subsearch and main search.</P> Sat, 16 May 2020 05:53:18 GMT sree6494 2020-05-16T05:53:18Z https://community.splunk.com/t5/Splunk-Search/get-count-of-subsearch-and-main-search/m-p/497979#M138722 <P>Iam trying to get a inner join result which looks some thing like if there are 100 unique fields from subsearch, I want to confirm if each field is present in the main search and get the count if presents. get count of subsearch and main search.</P> Sat, 16 May 2020 05:53:18 GMT https://community.splunk.com/t5/Splunk-Search/get-count-of-subsearch-and-main-search/m-p/497979#M138722 sree6494 2020-05-16T05:53:18Z https://community.splunk.com/t5/Splunk-Search/get-count-of-subsearch-and-main-search/m-p/497980#M138723 <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join</A></P> Sat, 16 May 2020 12:55:02 GMT https://community.splunk.com/t5/Splunk-Search/get-count-of-subsearch-and-main-search/m-p/497980#M138723 to4kawa 2020-05-16T12:55:02Z https://community.splunk.com/t5/Splunk-Search/get-count-of-subsearch-and-main-search/m-p/497981#M138724 <P>to4kawa - Iam able to do the inner join but struggling with getting the count. Are you suggesting the alternatives of join statement for this purpose?</P> Mon, 18 May 2020 19:52:14 GMT https://community.splunk.com/t5/Splunk-Search/get-count-of-subsearch-and-main-search/m-p/497981#M138724 sree6494 2020-05-18T19:52:14Z https://community.splunk.com/t5/Splunk-Search/get-count-of-subsearch-and-main-search/m-p/497982#M138725 <P>index=A "SMSSent=[1]" earliest=-11m@m latest=-1m@m<BR /> | join type=inner MessageID [ search index=A "DeliveryReceipt=[1]" earliest=-12m@m latest=-0m@m ]</P> <P>here Im getting the results from my main search and mapping it with sub search. I am wondering how the count can be calculated for main search results and count for the join results. </P> Mon, 18 May 2020 20:48:31 GMT https://community.splunk.com/t5/Splunk-Search/get-count-of-subsearch-and-main-search/m-p/497982#M138725 sree6494 2020-05-18T20:48:31Z https://community.splunk.com/t5/Splunk-Search/get-count-of-subsearch-and-main-search/m-p/497983#M138726 <PRE><CODE>index=A "SMSSent=[1]" earliest=-11m@m latest=-1m@m | eval flag="SMS" | append [ search index=A "DeliveryReceipt=[1]" earliest=-12m@m latest=-0m@m | eval flag="DR"] | stats count by flag </CODE></PRE> <P>how about this?</P> Tue, 19 May 2020 09:15:26 GMT https://community.splunk.com/t5/Splunk-Search/get-count-of-subsearch-and-main-search/m-p/497983#M138726 to4kawa 2020-05-19T09:15:26Z https://community.splunk.com/t5/Splunk-Search/get-count-of-subsearch-and-main-search/m-p/497984#M138727 <P>this is great, but the subsearch results aren't a subset of the main search results(based on the MessageID field), which is the challenge</P> Tue, 19 May 2020 13:29:43 GMT https://community.splunk.com/t5/Splunk-Search/get-count-of-subsearch-and-main-search/m-p/497984#M138727 sree6494 2020-05-19T13:29:43Z https://community.splunk.com/t5/Splunk-Search/get-count-of-subsearch-and-main-search/m-p/497985#M138728 <P>I have no idea what log you want to count.</P> <P>my answer result:</P> <PRE><CODE>flag count DR xxx SMS XXX </CODE></PRE> <P>comparison:</P> <PRE><CODE>index=A "SMSSent=[1]" earliest=-11m@m latest=-1m@m | eval flag="SMS" | append [ search index=A "DeliveryReceipt=[1]" earliest=-12m@m latest=-0m@m | eval flag="DR"] | stats count(eval(flag="SMS"))) as SMS count(eval(flag="DR"))) as DR | eval compare = DR -SMS </CODE></PRE> <P>this result:</P> <PRE><CODE>DR SMS compare XXX YYY ZZ </CODE></PRE> Tue, 19 May 2020 13:58:45 GMT https://community.splunk.com/t5/Splunk-Search/get-count-of-subsearch-and-main-search/m-p/497985#M138728 to4kawa 2020-05-19T13:58:45Z