Splunk Search

How to search and filter based on fields created by stats?

mgubser
Explorer

Howdy,
I have a stats search that returns values from fields in different events such as OS Devicetype etc. This information is being combined by the shared field IP. My current search is

... | stats values(Devicetype), values(OS) by IP

This returns a pretty table of all the data I want to see. I am looking for a way to search and filter based on these fields created by stats. I need to be able to search multiple fields. Any suggestions would be appreciated.

Tags (4)
1 Solution

MuS
Legend

Hi mgubser,

Based on your provided example try somthing like this:

 ... | stats values(Devicetype) AS Devicetype, values(OS) AS OS by IP

Now you will get the results back as fields which can be used in further Splunk commands.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi mgubser,

Based on your provided example try somthing like this:

 ... | stats values(Devicetype) AS Devicetype, values(OS) AS OS by IP

Now you will get the results back as fields which can be used in further Splunk commands.

Hope this helps ...

cheers, MuS

djconroy
Path Finder

Thank you so much for this insight... I was struggling with filtering my stats results until I realized that I needed the AS to create a field to use for filtering.

MuS
Legend

You're welcome 🙂

0 Karma

mgubser
Explorer

Thanks so much, it's the little things that get me.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...