topic Re: Subquery Event count in not work i need to count sub query in Splunk Search

Subquery Event count in not work i need to count sub query

nitesh218ss — Wed, 06 May 2015 09:28:32 GMT

i create query in which i search unique no of values of one field and that unique value join to other query they work properly

But when i use [stats count] in subquery they not work i want to count total no of result in subquery. i want to subtract sub query count with total result

if you see i add [stats count as totall] in sub query

Re: Subquery Event count in not work i need to count sub query

vganjare — Wed, 06 May 2015 09:50:56 GMT

Hi,

You can try using eventstats instead of stats. Ideally, the join command expects one or many common fields on both sides of the command. i.e. first query should have "audit" field and the subsearch should also have "audit" field.

Thanks!!

Re: Subquery Event count in not work i need to count sub query

nitesh218ss — Wed, 06 May 2015 11:14:41 GMT

i use this way they run but in result how i get in result they show field result and count(audit) only not show sub query count
my query is:
| eval ll=substr(message,0,18) | where ll="getLogMsg returned" | rex field=message "^71^+(?<myAp>[^^]+)^" | eval result=if(myAp = 00,"sucess","fail") | join audit [search index="uk" sourcetype="uk18" serviceType=1 | dedup audit|fields + audit | eventstats count as kk ] |stats count(audit) by result