How to make stats count result value become filters in search/dashboard

[b1211ry]

Hi,

I need to call the result value as a filter. like this table below, the second value on column RecipientDomain will call on search as filter. become this query:

index=sec_office365_dlp sourcetype=sec_office365_dlp RecipientDomain=@yahoo.com | stats count by xxx

Help please..

[richgalloway]

How does Splunk know which RecipientDomain value to use?  Is it always the second?

[b1211ry]

Yes @richgalloway , we always use the second one value.

[richgalloway · Accepted solution]

You need a subsearch.  The subsearch runs first and selects the value the main search will look for.

index=sec_office365_dlp sourcetype=sec_office365_dlp [ index=sec_office365_dlp sourcetype=sec_office365_dlp RecipientDomain IN (@gmail.com @yahoo.com @hotmail.com) 
  | stats count by RecipientDomain
  | sort limit=2 - count
  | tail 1
  | return RecipientDomain ]
| stats count by xxx

The subsearch selects the last (tail 1) result from the two produced by sort, which is the same as the second of three.

[b1211ry]

Thanks for your help @richgalloway .  It works!!👍