topic Re: Use two stats function with different group by in Splunk Search

Use two stats function with different group by

rj — Fri, 20 Aug 2021 07:37:16 GMT

how to get this two stats result in one query

(earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv")))

| stats latest(first) as first
latest(last) as last
latest(index) as index
by dev_id dq (this dq field is not present in ho_sum)

| stats latest(first) as first_vu
latest(last) as last_vu
latest(index) as index_1
by dev_id sourcetype

Re: Use two stats function with different group by

skramp — Fri, 20 Aug 2021 07:49:20 GMT

(earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv")))
| stats latest(first) as first
latest(last) as last
latest(index) as index
by dev_id dq (this dq field is not present in ho_sum)

| append [search (earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv")))
| stats latest(first) as first_vu
latest(last) as last_vu
latest(index) as index_1
by dev_id sourcetype]

Here you have one query but two searches but one result set. Using it this way isn't that nice because as mentioned you have two separate searches.

Re: Use two stats function with different group by

rj — Fri, 20 Aug 2021 10:26:56 GMT

yes ,i have two different searches ,but i need to use output of one filed and to use in another

Re: Use two stats function with different group by

skramp — Fri, 20 Aug 2021 11:54:38 GMT

Then my solution seams to solve your problem. Have you tried to let it run like my suggestion was? Put the whole text (both blocks) into your search bar.

Re: Use two stats function with different group by

rj — Mon, 23 Aug 2021 05:34:55 GMT

thankyou for the reply ,is there is any other way of doing it

Re: Use two stats function with different group by

skramp — Mon, 23 Aug 2021 07:30:34 GMT

You can try this, but I don't know if that is the solution you need:

(earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv")))
| fillnull dq
| stats latest(first) as first
latest(last) as last
latest(index) as index
by dev_id dq sourcetype