https://community.splunk.com/t5/Splunk-Search/Passing-dynamic-value-from-stats-to-the-remaining-part-of-search/m-p/333141#M99064 <P>Awesome.. This worked.. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Thanks a lot</P> Tue, 31 Oct 2017 06:19:36 GMT k_harini 2017-10-31T06:19:36Z https://community.splunk.com/t5/Splunk-Search/Passing-dynamic-value-from-stats-to-the-remaining-part-of-search/m-p/333137#M99060 <P>I want to pass latest_date for null value so that inprogress count sits there as there is no completion date for inprogress records. Thats the ask. Here latest_date is not passed as token. Im just getting string latest date. is this doable? can some one help? </P> <PRE><CODE> index="test" IG="*" |rename "Completion Date" as completed_date "Savings in k" as Dollar_Savings|eventstats last(completed_date) as latest_date|fillnull value=latest_date completed_date | stats count(eval(('Assessment Status'="Closed") OR ('Assessment Status'="Completed"))) as "# of Assessments completed (Projects)" sum(Dollar_Savings) as "Cost Savings Committed (K $)" sum("FTE impact") as FTE_impact sum("Baseline FTE") as baseline_FTE count(eval('Assessment Status'="In Progress")) as "# of Assessments In-progress" by completed_date </CODE></PRE> Tue, 29 Sep 2020 16:28:08 GMT https://community.splunk.com/t5/Splunk-Search/Passing-dynamic-value-from-stats-to-the-remaining-part-of-search/m-p/333137#M99060 k_harini 2020-09-29T16:28:08Z https://community.splunk.com/t5/Splunk-Search/Passing-dynamic-value-from-stats-to-the-remaining-part-of-search/m-p/333138#M99061 <P>I could do this by passing it as token from different query. Just want to know if it can be done in a single query instead of calling index twice</P> Wed, 25 Oct 2017 10:32:56 GMT https://community.splunk.com/t5/Splunk-Search/Passing-dynamic-value-from-stats-to-the-remaining-part-of-search/m-p/333138#M99061 k_harini 2017-10-25T10:32:56Z https://community.splunk.com/t5/Splunk-Search/Passing-dynamic-value-from-stats-to-the-remaining-part-of-search/m-p/333139#M99062 <P>You can use the map command to pass on completed_date from base search to new search within same SPL.<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Map" target="_blank">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Map</A></P> <P>I however, feel eventstats is not required if you have your subsequent stats command return single result (since there is only one last(completed_date) as latest_date used as stats split by field. You even don't need the rename command and fillnull.</P> <PRE><CODE>index="test" IG="*" | stats count(eval(('Assessment Status'="Closed") OR ('Assessment Status'="Completed"))) as "# of Assessments completed (Projects)" sum(Dollar_Savings) as "Cost Savings Committed (K $)" sum("FTE impact") as FTE_impact sum("Baseline FTE") as baseline_FTE count(eval('Assessment Status'="In Progress")) as "# of Assessments In-progress" last("Completion Date") as latest_date | map search="| makeresults | eval DateSelected=\"$latest_date$\"" </CODE></PRE> <P>You need to replace map SPL query with your own. Make sure all double quotes in inner query are escaped with backslash and use $latest_date$ value as token from the base search.<BR /> Please try out and confirm.</P> Tue, 29 Sep 2020 16:25:12 GMT https://community.splunk.com/t5/Splunk-Search/Passing-dynamic-value-from-stats-to-the-remaining-part-of-search/m-p/333139#M99062 niketn 2020-09-29T16:25:12Z https://community.splunk.com/t5/Splunk-Search/Passing-dynamic-value-from-stats-to-the-remaining-part-of-search/m-p/333140#M99063 <P>I believe what you want to do is replace the <CODE>fillnull</CODE> portion with the following:</P> <PRE><CODE>...| eval completed_date=if(isnull(completed_date), latest_date, completed_date) | ... </CODE></PRE> <P>The value X in <CODE>fillnull value=X</CODE> is always treated as a string. In your case, the string "latest_value".</P> Wed, 25 Oct 2017 19:45:34 GMT https://community.splunk.com/t5/Splunk-Search/Passing-dynamic-value-from-stats-to-the-remaining-part-of-search/m-p/333140#M99063 khaynes_splunk 2017-10-25T19:45:34Z https://community.splunk.com/t5/Splunk-Search/Passing-dynamic-value-from-stats-to-the-remaining-part-of-search/m-p/333141#M99064 <P>Awesome.. This worked.. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> Thanks a lot</P> Tue, 31 Oct 2017 06:19:36 GMT https://community.splunk.com/t5/Splunk-Search/Passing-dynamic-value-from-stats-to-the-remaining-part-of-search/m-p/333141#M99064 k_harini 2017-10-31T06:19:36Z https://community.splunk.com/t5/Splunk-Search/Passing-dynamic-value-from-stats-to-the-remaining-part-of-search/m-p/333142#M99065 <P>Thanks for your time. I will try this.. </P> Tue, 31 Oct 2017 06:19:55 GMT https://community.splunk.com/t5/Splunk-Search/Passing-dynamic-value-from-stats-to-the-remaining-part-of-search/m-p/333142#M99065 k_harini 2017-10-31T06:19:55Z