Splunk Search

How to search and filter based on fields created by stats?

mgubser
Explorer

Howdy,
I have a stats search that returns values from fields in different events such as OS Devicetype etc. This information is being combined by the shared field IP. My current search is

... | stats values(Devicetype), values(OS) by IP

This returns a pretty table of all the data I want to see. I am looking for a way to search and filter based on these fields created by stats. I need to be able to search multiple fields. Any suggestions would be appreciated.

Tags (4)
1 Solution

MuS
Legend

Hi mgubser,

Based on your provided example try somthing like this:

 ... | stats values(Devicetype) AS Devicetype, values(OS) AS OS by IP

Now you will get the results back as fields which can be used in further Splunk commands.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi mgubser,

Based on your provided example try somthing like this:

 ... | stats values(Devicetype) AS Devicetype, values(OS) AS OS by IP

Now you will get the results back as fields which can be used in further Splunk commands.

Hope this helps ...

cheers, MuS

djconroy
Path Finder

Thank you so much for this insight... I was struggling with filtering my stats results until I realized that I needed the AS to create a field to use for filtering.

MuS
Legend

You're welcome 🙂

0 Karma

mgubser
Explorer

Thanks so much, it's the little things that get me.

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...