Splunk Search

How to search and filter based on fields created by stats?

mgubser
Explorer

Howdy,
I have a stats search that returns values from fields in different events such as OS Devicetype etc. This information is being combined by the shared field IP. My current search is

... | stats values(Devicetype), values(OS) by IP

This returns a pretty table of all the data I want to see. I am looking for a way to search and filter based on these fields created by stats. I need to be able to search multiple fields. Any suggestions would be appreciated.

Tags (4)
1 Solution

MuS
Legend

Hi mgubser,

Based on your provided example try somthing like this:

 ... | stats values(Devicetype) AS Devicetype, values(OS) AS OS by IP

Now you will get the results back as fields which can be used in further Splunk commands.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi mgubser,

Based on your provided example try somthing like this:

 ... | stats values(Devicetype) AS Devicetype, values(OS) AS OS by IP

Now you will get the results back as fields which can be used in further Splunk commands.

Hope this helps ...

cheers, MuS

djconroy
Path Finder

Thank you so much for this insight... I was struggling with filtering my stats results until I realized that I needed the AS to create a field to use for filtering.

MuS
Legend

You're welcome 🙂

0 Karma

mgubser
Explorer

Thanks so much, it's the little things that get me.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...