Running separate searches from a base search?

[szabados]

I have a long search, where in the first part, I'm filtering down lots of data, and doing lookup, eval, etc, let's call this my base search
At the end, I want to apply stats to this data set, actually three different functions, and have the results in a table.
I'm able to do this, by running the base search 3 times, applying one of the stats function, and appending it to the other results, like this:

| basesearch | stats 1
| append [|basesearch | stats 2]
| append [|basesearch | stats 3]

Obviously, this is a huge overhead of running the same search 3 times in subsearches. I can't use a datamodel, because the parameters of my subsearch are dynamically populated, and it would be almost impossible to create all the summaries for all the possible values.

Is there any way, to do something like this?

| basesearch
| stats1
| append [| stats2 appended to the data yielded from the base search at the beginning]
| append [| stats3 appended to the data yielded from the base search at the beginning]

Thanks

[somesoni2 · Accepted solution]

How about this (works best if you've filtered down number of rows after base search signifacantly)

| basesearch | eval exclude=1
| appendpipe [| stats 1 | eval exclude=0 ]
 | appendpipe [| where exclude=1  | stats 2  | eval exclude=0 ]
| appendpipe [| where exclude=1  | stats 3  | eval exclude=0 ]
| where exclude=0

[szabados]

Thanks, exactly what I needed!

[snoobzilla]

Can you add eval/case statements that allow you to do stats2 and stats3 at the same time as you do stats 1?

There was a great presentation on this at .conf2016 by Nick from Sideview. May be worth a look.

https://conf.splunk.com/sessions/2016-sessions.html#search=Let%20Stats%20Sort%20Them%20Out%3A%20Buil...