How to search data on multiple days, days which are determined by another search?

[gibir]

I want to determine the top n days of a time period based on a criteria and then get some statistics only on those days.
Do I use a subsearch?
I can write the searches for these two things separately but I cannot link them. Also I don't know how to pass specific days as parameters to my search.

I have something like this for determining the days:

index=potato
| bin _time span=1d
| stats sum(piece) AS sum_piece BY _time
| sort -sum_piece
| head 3

How can I pass this? Or is there a simpler solution?

Thanks

[gcusello · Accepted solution]

Hi gibir,
let me know:
do you want to find the top three days and then use these dates in another search?

if this is your need you could try someting like this

index=my index 
| eval day=strftime(_time,"%Y-%m-%d")
| search [ search 
     index=potato
     | bin _time span=1d
     | stats sum(piece) AS sum_piece BY _time
     | sort -sum_piece
     | head 3
     | eval day=strftime(_time,"%Y-%m-%d")
     | fields day
     ]
| ...

If you want to use the same time boundaries of the subsearhc in the main search you could use:

index=my index [ search 
     index=potato
     | bin _time span=1d
     | stats sum(piece) AS sum_piece BY _time
     | sort -sum_piece
     | head 3
     | eval day=strftime(_time,"%Y-%m-%d")
     | stats earliest(day) AS earliest latest(day) AS latest values(day) AS day
     | fields earliest latest
     ]
| eval day=strftime(_time,"%Y-%m-%d")
| search [ search 
     index=potato
     | bin _time span=1d
     | stats sum(piece) AS sum_piece BY _time
     | sort -sum_piece
     | head 3
     | eval day=strftime(_time,"%Y-%m-%d")
     | fields day
     ]
| ...

Bye.
Giuseppe