Splunk Search

How to search and filter based on fields created by stats?

mgubser
Explorer

Howdy,
I have a stats search that returns values from fields in different events such as OS Devicetype etc. This information is being combined by the shared field IP. My current search is

... | stats values(Devicetype), values(OS) by IP

This returns a pretty table of all the data I want to see. I am looking for a way to search and filter based on these fields created by stats. I need to be able to search multiple fields. Any suggestions would be appreciated.

Tags (4)
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi mgubser,

Based on your provided example try somthing like this:

 ... | stats values(Devicetype) AS Devicetype, values(OS) AS OS by IP

Now you will get the results back as fields which can be used in further Splunk commands.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi mgubser,

Based on your provided example try somthing like this:

 ... | stats values(Devicetype) AS Devicetype, values(OS) AS OS by IP

Now you will get the results back as fields which can be used in further Splunk commands.

Hope this helps ...

cheers, MuS

View solution in original post

djconroy
Path Finder

Thank you so much for this insight... I was struggling with filtering my stats results until I realized that I needed the AS to create a field to use for filtering.

MuS
SplunkTrust
SplunkTrust

You're welcome 🙂

0 Karma

mgubser
Explorer

Thanks so much, it's the little things that get me.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!