Splunk Search

Can you help me write a subsearch?

Path Finder

Firstly, i am trying to separate 1) cachekey=false in one query and 2) cachekey=true in another query and 3) with both combined in one query. Also i want avg response time and perc90 response time. Where i am facing difficulty is that count 1 and 2 combined is not equal to the count in query #3. I don't know where it went wrong in the query. Experts please spare some time to pull me out of this.

Below are the query how i wrote


index=datapower CVSEVENT=EXIT opName="ABCD" status="SUCCESS" [search index=datapower opName=" 1234" cache ="false" | dedup grid | fields grid ]
| dedup grid
| table  respTime, grid | stats avg(respTime), perc90(respTime), count


index=datapower  opName="ABCD" status="SUCCESS" [search index=datapower opName="1234" cache ="true" | dedup grid | fields grid ]
| dedup grid
| table  respTime, grid | stats avg(respTime), perc90(respTime), count 


index=datapower  opName="ABCD" OR  opName="1234" status="SUCCESS" |stats avg(respTime), perc90(respTime), count by opName


Tags (1)
0 Karma

Splunk Employee
Splunk Employee

hi @Rocky31,

Did @DalJeanis answer your question? If so, please resolve this post by approving their answer below. If not, keep us updated so that someone else can help solve your problem.

Also, if you're feeling generous, give out an upvote to the user that helped ya. Our users love them upvotes. 🙂

0 Karma


There's no reason those three would match. Let's take the trivial situation where there is one or two of each

   index=datapower CVSEVENT=EVENT opName="ABCD" status="SUCCESS" grid=foo1 respTime=9
   index=datapower CVSEVENT=EVENT opName="ABCD" status="SUCCESS" grid=foo1 respTime=10  - DUP will be dropped
   index=datapower opName="1234" status="SUCCESS" grid=foo1 cache="true"
   index=datapower CVSEVENT=EVENT opName="ABCD" status="SUCCESS" grid=foo2 respTime=15
   index=datapower opName="1234" status="SUCCESS" grid=foo2 cache="true"
   index=datapower opName="ABCD" status="SUCCESS" grid=foo3 respTime=18
   index=datapower opName="1234" status="SUCCESS" grid=foo3 cache="false"

results 1
    avg=12 count=2

results 2
    avg=18 count=1

results 3
   opname="1234", count=2

You can try something like this for a consolidated report. No guarantee on this one, because I don't know your data.

(index=datapower opName="ABCD" status="SUCCESS") OR
(index=datapower opName="1234")
| fields opName grid CVSEVENT respTime cache
| dedup opName grid CVSEVENT respTime
| dedup opName grid cache
| stats values(*) as * by grid 

| stats avg(respTime) as avgResp p90(respTime) as p90Resp count by opName cache
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...