Splunk Search

Is it possible to run a subsearch within a stats function?

New Member

Hi would like to know is there a way to do queries like,

search * | stats values(field1) , values(subquery[field1])  
0 Karma

SplunkTrust
SplunkTrust

You can do this:

| stats count | eval foo = "bar" | stats values(count), [stats count as search | eval search = "values(foo)"]

Essentially, the second function and/or field name are evaluated and returned by the subsearch. Adding the values() within the subsearch seems to be necessary to not run into any errors, at least based on my quick testing.

0 Karma

Splunk Employee
Splunk Employee

Subsearches are not supported within stats based evals.

SplunkTrust
SplunkTrust

In addition, read https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo... and watch the March 2016 virtual.conf talk from http://wiki.splunk.com/Virtual_.conf for more info how this can be done without subsearches 😉

0 Karma