Is there a way to make an appended search (or subsearch) respect the outer search's sample constraint?

[dadkinson]

"XXX targeting service enabled" | stats count as ALL | appendcols [search "exception calling XXX targeting" | stats count as EXC] | eval ratio=ALL/EXC

Search works fine and generates correct ratio when no sampling is made, but if I want to sample, the outer search is fine but the inner runs through the complete event space.

no sample:
ALL: 12182689
EXC: 83363
ratio: 146.140242

1:1000 sample:
ALL: 12108
EXC: 83363
ratio: 0.145244

Easy enough to interpret but it'd be good to know if there's a way to enforce sampling throughout the complete search.

Thanks.

[hunters_splunk · Accepted solution]

Hi dadkinson,

Not sure if I understand your question correctly, but the stats command is not a good candidate for event sampling. Please refer to the documentation here:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Retrieveasamplesetofevents#Commands_and_fun...

Thanks
Hunter

[dadkinson]

Ah yes, I'd forgotten about that note. Thanks.