Splunk Search

Is it possible to run a subsearch within a stats function?

ethanrulez80
New Member

Hi would like to know is there a way to do queries like,

search * | stats values(field1) , values(subquery[field1])  
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can do this:

| stats count | eval foo = "bar" | stats values(count), [stats count as search | eval search = "values(foo)"]

Essentially, the second function and/or field name are evaluated and returned by the subsearch. Adding the values() within the subsearch seems to be necessary to not run into any errors, at least based on my quick testing.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Subsearches are not supported within stats based evals.

MuS
Legend

In addition, read https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo... and watch the March 2016 virtual.conf talk from http://wiki.splunk.com/Virtual_.conf for more info how this can be done without subsearches :winking_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...