How to use inner search in tstats?

[ugy]

Hello Team,

I'd like to know about How to use inner search in tstats?

I use that

| tstats count from datamodel=ITSI_DM where [ search index=idx_qq sourcetype=q1 | stats c by AAA] by ITSI_DM_NM.AAA

But No Result.
How to use inner search in tstats?

[rjthibod · Accepted solution]

You are close but you need to limit the output of your inner search to the one field that should be used for filtering.

| tstats count from datamodel=ITSI_DM where [search index=idx_qq sourcetype=q1 | stats c by AAA | sort 10 -c | fields AAA | rename AAA as ITSI_DM_NM.AAA] by ITSI_DM_NM.AAA

[ugy]

Thank you for your Answer!