topic Re: Conditional Aggregate in Getting Data In

Conditional Aggregate- How to search all entityID's with count?

bmer — Mon, 15 Aug 2022 13:36:04 GMT

I have below splunk which gets me all entityID's with count

index=coreprod pod=xxxx CASE(xxxxxx) event=ack |stats count by entityId |where count>1

I want to list ONLY those entityID's where the difference between their occurrence is less than 1hr (0r xx min

Re: Conditional Aggregate

ITWhisperer — Fri, 12 Aug 2022 12:52:25 GMT

index=coreprod pod=xxxx CASE(xxxxxx) event=ack earliest=-1h | stats count by entityId |where count>1

Re: Conditional Aggregate

bmer — Fri, 12 Aug 2022 12:58:22 GMT

Thanks @ITWhisperer But this is ONLY for LAST 1h. I want to pull all output of YESTERDAY and see within that how many duplicate events had a gap of 1h or 30m or xx

Re: Conditional Aggregate

ITWhisperer — Fri, 12 Aug 2022 14:25:59 GMT

Do you mean something like this?

index=coreprod pod=xxxx CASE(xxxxxx) event=ack | streamstats range(_time) as range global=f window=2 by entityId | where range < 3600 | stats count

Re: Conditional Aggregate

bmer — Sat, 13 Aug 2022 00:08:42 GMT

@ITWhisperer Let me try explaining with an example.My original splunk gives below output for YESTERDAY.I know that A2 and A3 event occurred within a span of 30min whereas BOTH the A1 events occurred within a gap of 2h

entityId	Count
A1	2
A2	2
A3	3

Iam trying to see (using splunk) if there is some way to list ONLY for YESTERDAY since these 2 records fulfil the criteria of having occurred within 30min

entityId	Count
A2	2
A3	3

Re: Conditional Aggregate

ITWhisperer — Sat, 13 Aug 2022 06:43:13 GMT