stats option compatibility - Splunk Community

Splunk Search

Does stats support function inside function like shown below ?

Where first i want to take percentile90 of PERCENT90 field value and then sum it up by function as shown below in query

 search........... | eval PERCENT90=round(PERCENT90,2)  |  eval DAY=strftime(_time, "%d-%m-%Y:%H:%M:%S")    |  stats DC(DAY) as DayCount **sum(Perc90(PERCENT90))**  by FUNCTION

I am trying to get the below result

search........ | rex field=source "APP_(?.*)"  | eval PERCENT90=round(PERCENT90,2)  |  eval DAY=strftime(_time, "%d-%m-%Y:%H:%M:%S")    | stats **Perc90**(PERCENT90) as **record** |   stats DC(DAY) as DayCount **sum(record)** as SUMA by FUNCTION

so I want to pass the percentile90 calculation done from first stats to next stats sum()

try changing | stats perc90(PERCENT90) to | eventstats perc90(PERCENT90)

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...