Splunk Search

How to get Stats on outer search?

davalabih
Engager

I was trying the mentioned operation but not getting the expected result.

1. need ID from sub search which is  the join parameter

2. apply stats on the outer query

Stats are getting applied to inner query instead

index=* methodName=* success=true | join ID [|SEARCH index=* Success=true ]|stats count(eval(Success="true")) as SuccessRate,count(eval(Success="false")) as FailureRate by Action

Appreciate quick help on this

Labels (3)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You possibly need to specify it as an outer join?

| join type=outer ID [search ...

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You possibly need to specify it as an outer join?

| join type=outer ID [search ...
0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...