Revision history [back]

In Splunk, a subsearch result can be assigned to a variable using the "foreach" command. Here is an example:

| foreach subresult [search index=main | stats count by sourcetype | fields - count]

In this example, the subsearch is enclosed in square brackets and is preceded by the "foreach" command. The result of the subsearch is assigned to the "subresult" variable, which can then be used in subsequent commands.