https://community.splunk.com/t5/Splunk-Search/How-to-search-and-filter-based-on-fields-created-by-stats/m-p/116591#M30970 <P>Howdy, <BR /> I have a stats search that returns values from fields in different events such as OS Devicetype etc. This information is being combined by the shared field IP. My current search is </P> <PRE><CODE>... | stats values(Devicetype), values(OS) by IP </CODE></PRE> <P>This returns a pretty table of all the data I want to see. I am looking for a way to search and filter based on these fields created by stats. I need to be able to search multiple fields. Any suggestions would be appreciated. </P> Tue, 09 Sep 2014 05:05:03 GMT mgubser 2014-09-09T05:05:03Z https://community.splunk.com/t5/Splunk-Search/How-to-search-and-filter-based-on-fields-created-by-stats/m-p/116591#M30970 <P>Howdy, <BR /> I have a stats search that returns values from fields in different events such as OS Devicetype etc. This information is being combined by the shared field IP. My current search is </P> <PRE><CODE>... | stats values(Devicetype), values(OS) by IP </CODE></PRE> <P>This returns a pretty table of all the data I want to see. I am looking for a way to search and filter based on these fields created by stats. I need to be able to search multiple fields. Any suggestions would be appreciated. </P> Tue, 09 Sep 2014 05:05:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-and-filter-based-on-fields-created-by-stats/m-p/116591#M30970 mgubser 2014-09-09T05:05:03Z https://community.splunk.com/t5/Splunk-Search/How-to-search-and-filter-based-on-fields-created-by-stats/m-p/116592#M30971 <P>Hi mgubser,</P> <P>Based on your provided example try somthing like this:</P> <PRE><CODE> ... | stats values(Devicetype) AS Devicetype, values(OS) AS OS by IP </CODE></PRE> <P>Now you will get the results back as fields which can be used in further Splunk commands.</P> <P>Hope this helps ...</P> <P>cheers, MuS</P> Tue, 09 Sep 2014 05:35:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-and-filter-based-on-fields-created-by-stats/m-p/116592#M30971 MuS 2014-09-09T05:35:57Z https://community.splunk.com/t5/Splunk-Search/How-to-search-and-filter-based-on-fields-created-by-stats/m-p/116593#M30972 <P>Thanks so much, it's the little things that get me.</P> Tue, 09 Sep 2014 06:14:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-and-filter-based-on-fields-created-by-stats/m-p/116593#M30972 mgubser 2014-09-09T06:14:30Z https://community.splunk.com/t5/Splunk-Search/How-to-search-and-filter-based-on-fields-created-by-stats/m-p/116594#M30973 <P>You're welcome <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 09 Sep 2014 06:15:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-and-filter-based-on-fields-created-by-stats/m-p/116594#M30973 MuS 2014-09-09T06:15:25Z https://community.splunk.com/t5/Splunk-Search/How-to-search-and-filter-based-on-fields-created-by-stats/m-p/116595#M30974 <P>Thank you so much for this insight... I was struggling with filtering my stats results until I realized that I needed the AS to create a field to use for filtering.</P> Wed, 25 Feb 2015 17:11:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-and-filter-based-on-fields-created-by-stats/m-p/116595#M30974 djconroy 2015-02-25T17:11:32Z