https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-total-in-a-subsearch-with-only-totals-that/m-p/112963#M29682 <P>the output looks like this:<BR /> Source-----------------------Destination-----------------------------subtotal----------------Total<BR /> 1.1.1.1 2.2.2.2 3 5<BR /> 3.3.3.3 2 </P> Fri, 10 Jul 2015 15:09:23 GMT Dallastek 2015-07-10T15:09:23Z https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-total-in-a-subsearch-with-only-totals-that/m-p/112961#M29680 <PRE><CODE>sourcetype=mysource Name=web_access `myfilter` | stats count(Source_Host) as temp by Source_Host, Dest_Host | sort -temp | eval subtotal = temp." " | stats list(Source_Host) AS Destination, list(subtotal) as Subtotal, sum(temp) as Total by Dest_Host | eval Total = Total." " | sort - Total | rename Dest_Host AS Source </CODE></PRE> <P>Tried a subsearch but, no joy-</P> <PRE><CODE>sourcetype=mysource Name=web_access `myfilter` | stats count(Source_Host) as temp by Source_Host, Dest_Host | sort -temp | eval subtotal = temp." " | stats list(Source_Host) AS Destination, list(subtotal) as Subtotal, sum(temp) as Total by Dest_Host | eval Total = Total." " | sort - Total | rename Dest_Host AS Source | search | stats count by Source, Total | where count &gt;100 </CODE></PRE> Fri, 10 Jul 2015 14:38:04 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-total-in-a-subsearch-with-only-totals-that/m-p/112961#M29680 Dallastek 2015-07-10T14:38:04Z https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-total-in-a-subsearch-with-only-totals-that/m-p/112962#M29681 <P>that is actually two separate searches, It all got mushed together when I posted <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 10 Jul 2015 14:44:48 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-total-in-a-subsearch-with-only-totals-that/m-p/112962#M29681 Dallastek 2015-07-10T14:44:48Z https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-total-in-a-subsearch-with-only-totals-that/m-p/112963#M29682 <P>the output looks like this:<BR /> Source-----------------------Destination-----------------------------subtotal----------------Total<BR /> 1.1.1.1 2.2.2.2 3 5<BR /> 3.3.3.3 2 </P> Fri, 10 Jul 2015 15:09:23 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-total-in-a-subsearch-with-only-totals-that/m-p/112963#M29682 Dallastek 2015-07-10T15:09:23Z https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-total-in-a-subsearch-with-only-totals-that/m-p/112964#M29683 <P>Again I posted 2 seperate searches to show what I have tried, I dont run BOTH searches</P> Fri, 10 Jul 2015 15:10:21 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-total-in-a-subsearch-with-only-totals-that/m-p/112964#M29683 Dallastek 2015-07-10T15:10:21Z https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-total-in-a-subsearch-with-only-totals-that/m-p/112965#M29684 <P>Sorry if this seems confusing. really what I need is to only show events that are greater than 100 in the total column.</P> Fri, 10 Jul 2015 15:46:04 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-total-in-a-subsearch-with-only-totals-that/m-p/112965#M29684 Dallastek 2015-07-10T15:46:04Z https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-total-in-a-subsearch-with-only-totals-that/m-p/112966#M29685 <P>If your first search works, then this should do it:</P> <PRE><CODE>sourcetype=mysource Name=web_access `myfilter` | stats count(Source_Host) as temp by Source_Host, Dest_Host | sort -temp | eval subtotal = temp." " | stats list(Source_Host) AS Destination, list(subtotal) as Subtotal, sum(temp) as Total by Dest_Host | eval count=Total | eval Total = Total." " | sort - Total | rename Dest_Host AS Source | where count&gt;100 | fields - count </CODE></PRE> <P>BTW, this is not called a <CODE>subsearch</CODE>, and it confused the question very much that you used that term. I suppose this might be called a <CODE>postsearch</CODE>...?</P> Fri, 10 Jul 2015 15:59:26 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-total-in-a-subsearch-with-only-totals-that/m-p/112966#M29685 woodcock 2015-07-10T15:59:26Z https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-total-in-a-subsearch-with-only-totals-that/m-p/112967#M29686 <P>That works thanks!!</P> Fri, 10 Jul 2015 16:45:59 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-count-the-total-in-a-subsearch-with-only-totals-that/m-p/112967#M29686 Dallastek 2015-07-10T16:45:59Z