Is it possible to run a subsearch within a stats function?

[ethanrulez80]

Hi would like to know is there a way to do queries like,

search * | stats values(field1) , values(subquery[field1])  

[martin_mueller]

You can do this:

| stats count | eval foo = "bar" | stats values(count), [stats count as search | eval search = "values(foo)"]

Essentially, the second function and/or field name are evaluated and returned by the subsearch. Adding the values() within the subsearch seems to be necessary to not run into any errors, at least based on my quick testing.

[esix_splunk]

Subsearches are not supported within stats based evals.

[MuS]

In addition, read https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo... and watch the March 2016 virtual.conf talk from http://wiki.splunk.com/Virtual_.conf for more info how this can be done without subsearches 😉