splunk subsearch question

[splunk_novice99]

Hello, Im trying to use the data from one search in another search.  

This is what I'm trying to do:-
index=index_example  sourcetype=sourcetype_example
|chart count by Status
|eval output=(count/ [index=index_example  sourcetype=sourcetype_example |stats count] *100)

In the eval I just want [index=index_example  sourcetype=sourcetype_example |stats count] to be a single whole number

[yuanliu]

---

In the eval I just want [index=index_example  sourcetype=sourcetype_example |stats count] to be a single whole number

---

First, this is not what subsearch is for.  A subsearch populates a group of fields, not outputs a single value.  If you use format command to view its actual output,

index=index_example  sourcetype=sourcetype_example |stats count |format

 you will see that it is equivalent to "count=86" or whatever the count is.

Second, the subsearch retrieves the same set of events as the main search.  This is very wasteful.  It would be much more productive to present the problem you are trying to solve than focusing on a particular search command.

Let me take a wild guess: You want to calculate percentage of count by status in total count.  Is this correct?  There are many ways to achieve this.  None of them requires subsearch of same events.  This is an example.

index=index_example  sourcetype=sourcetype_example
|chart count by Status
| eventstats sum(count) as total
| eval output =  count / total * 100
| fields - total

[splunk_novice99]

Hi Yuanliu,

Yes, you're absolutely right, I do want to calculate percentage of count by status in total count.

Thanks for your reply. I actually got there in the end using a subsearch but I see now this is not the correct way of doing things.  Your solution is obviously much more elegant so I'll be using that.  🙂

Thanks also for taking time to explain the correct use case for a subsearch.