How to search and filter based on fields created by stats?

[mgubser]

Howdy,
I have a stats search that returns values from fields in different events such as OS Devicetype etc. This information is being combined by the shared field IP. My current search is

... | stats values(Devicetype), values(OS) by IP

This returns a pretty table of all the data I want to see. I am looking for a way to search and filter based on these fields created by stats. I need to be able to search multiple fields. Any suggestions would be appreciated.

[MuS · Accepted solution]

Hi mgubser,

Based on your provided example try somthing like this:

 ... | stats values(Devicetype) AS Devicetype, values(OS) AS OS by IP

Now you will get the results back as fields which can be used in further Splunk commands.

Hope this helps ...

cheers, MuS

[djconroy]

Thank you so much for this insight... I was struggling with filtering my stats results until I realized that I needed the AS to create a field to use for filtering.

[MuS]

You're welcome 🙂

[mgubser]

Thanks so much, it's the little things that get me.