<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Kindly build this in single query. in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754404#M119764</link>
    <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957"&gt;@richgalloway&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Could you pls validate my search &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="_Raj_0-1760610709233.png" style="width: 931px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/40567i1AD865B1D5F392E9/image-dimensions/931x378?v=v2" width="931" height="378" role="button" title="_Raj_0-1760610709233.png" alt="_Raj_0-1760610709233.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;Thanks&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Thu, 16 Oct 2025 10:32:32 GMT</pubDate>
    <dc:creator>_Raj</dc:creator>
    <dc:date>2025-10-16T10:32:32Z</dc:date>
    <item>
      <title>Kindly build this in single query.</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754355#M119752</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Sample Data (CSV format) –&amp;nbsp;&lt;BR /&gt;student_id,student_name,class,school,subject,score&lt;BR /&gt;1,Alice,10A,School1,Math,85&lt;BR /&gt;2,Bob,10A,School1,Math,72&lt;BR /&gt;3,Charlie,10B,School1,Science,90&lt;BR /&gt;4,David,10A,School2,Math,65&lt;BR /&gt;5,Eva,10B,School2,Science,88&lt;/P&gt;&lt;P&gt;How to achieve this&amp;nbsp;Query : You need to get 2 ranks for students 1. At class level 2. At school level. Kindly build this in single query.&lt;/P&gt;</description>
      <pubDate>Wed, 15 Oct 2025 16:06:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754355#M119752</guid>
      <dc:creator>_Raj</dc:creator>
      <dc:date>2025-10-15T16:06:42Z</dc:date>
    </item>
    <item>
      <title>Re: Kindly build this in single query.</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754356#M119753</link>
      <description>&lt;P&gt;What have you tried so far and how did those attempts not meet expectations?&amp;nbsp; It would help to see a mock-up of the expected output.&lt;/P&gt;</description>
      <pubDate>Wed, 15 Oct 2025 16:38:04 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754356#M119753</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2025-10-15T16:38:04Z</dc:date>
    </item>
    <item>
      <title>Re: Kindly build this in single query.</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754379#M119756</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/249545"&gt;@_Raj&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Based on your previous questions it sounds like you are working through some exam/course questions? Has there been guidance on how to work out this SPL?&amp;nbsp;&lt;/P&gt;&lt;P&gt;Im therefore hesitant to just give an answer, but perhaps the following can help.&amp;nbsp;&lt;/P&gt;&lt;P&gt;I would start by visualising the sample data using the makeresults command:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;|makeresults format=csv data="student_id,student_name,class,school,subject,score
1,Alice,10A,School1,Math,85
2,Bob,10A,School1,Math,72
3,Charlie,10B,School1,Science,90
4,David,10A,School2,Math,65
5,Eva,10B,School2,Science,88"&lt;/LI-CODE&gt;&lt;P&gt;Then I would probably use stats to get the scores for each class, within each school...&lt;/P&gt;&lt;P&gt;Then if you want to retain the class scores but also get the score for each school then you might want to look at using &lt;A href="https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/9.3/search-commands/eventstats" target="_self"&gt;eventstats&lt;/A&gt; which will add a column to the existing stats.&amp;nbsp;&lt;/P&gt;&lt;P&gt;Sorry for not providing the full SPL but hopefully this will help &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;span class="lia-unicode-emoji" title=":glowing_star:"&gt;🌟&lt;/span&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;&lt;STRONG&gt;Did this answer help you?&lt;/STRONG&gt;&lt;SPAN&gt;&amp;nbsp;&lt;/SPAN&gt;If so, please consider:&lt;/P&gt;&lt;UL&gt;&lt;LI&gt;Adding karma to show it was useful&lt;/LI&gt;&lt;LI&gt;Marking it as the solution if it resolved your issue&lt;/LI&gt;&lt;LI&gt;Commenting if you need any clarification&lt;/LI&gt;&lt;/UL&gt;&lt;P&gt;Your feedback encourages the volunteers in this community to continue contributing&lt;/P&gt;</description>
      <pubDate>Wed, 15 Oct 2025 21:31:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754379#M119756</guid>
      <dc:creator>livehybrid</dc:creator>
      <dc:date>2025-10-15T21:31:44Z</dc:date>
    </item>
    <item>
      <title>Re: Kindly build this in single query.</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754386#M119757</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/249545"&gt;@_Raj&lt;/a&gt;&amp;nbsp;,&lt;/P&gt;&lt;P&gt;as also &lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957"&gt;@richgalloway&lt;/a&gt;&amp;nbsp;and &lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/170906"&gt;@livehybrid&lt;/a&gt;&amp;nbsp;said, your requirements aren't so clear, do you want to have the count of students for each class and for each school or what else?&lt;/P&gt;&lt;P&gt;and how do you want to display these results in the same table?&lt;/P&gt;&lt;P&gt;probably you could create different panels different searches in a dashboard.&lt;/P&gt;&lt;P&gt;Anyway, if you want to have the results in a single table (I don't understand why!), you could run something like this (resusing the data visualization of&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/170906"&gt;@livehybrid&lt;/a&gt;&amp;nbsp;&lt;span class="lia-unicode-emoji" title=":disappointed_face:"&gt;😞&lt;/span&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults format=csv data=
     "student_id,student_name,class,school,subject,score
     1,Alice,10A,School1,Math,85
     2,Bob,10A,School1,Math,72
     3,Charlie,10B,School1,Science,90
     4,David,10A,School2,Math,65
     5,Eva,10B,School2,Science,88"
| stats 
     count(eval(class="10A")) AS 10A_count
     count(eval(class="10B")) AS 10B_count
     count(eval(school="School1")) AS School1_count
     count(eval(school="School2")) AS School2_count&lt;/LI-CODE&gt;&lt;P&gt;Ciao.&lt;/P&gt;&lt;P&gt;Giuseppe&lt;/P&gt;</description>
      <pubDate>Thu, 16 Oct 2025 06:28:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754386#M119757</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2025-10-16T06:28:36Z</dc:date>
    </item>
    <item>
      <title>Re: Kindly build this in single query.</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754388#M119759</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/249545"&gt;@_Raj&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;As others mentioned, its not completely clear. But to start with if you are looking both class-level and school-level ranks, i would suggest use streamstats to put both results into one table&lt;/P&gt;&lt;P&gt;eg:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| streamstats count as class_rank by class

| streamstats count as school_rank by school&lt;/LI-CODE&gt;&lt;P&gt;Regards,&lt;BR /&gt;Prewin&lt;BR /&gt;If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!&lt;/P&gt;</description>
      <pubDate>Thu, 16 Oct 2025 06:48:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754388#M119759</guid>
      <dc:creator>PrewinThomas</dc:creator>
      <dc:date>2025-10-16T06:48:14Z</dc:date>
    </item>
    <item>
      <title>Re: Kindly build this in single query.</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754404#M119764</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957"&gt;@richgalloway&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Could you pls validate my search &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="_Raj_0-1760610709233.png" style="width: 931px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/40567i1AD865B1D5F392E9/image-dimensions/931x378?v=v2" width="931" height="378" role="button" title="_Raj_0-1760610709233.png" alt="_Raj_0-1760610709233.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;Thanks&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 16 Oct 2025 10:32:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754404#M119764</guid>
      <dc:creator>_Raj</dc:creator>
      <dc:date>2025-10-16T10:32:32Z</dc:date>
    </item>
    <item>
      <title>Re: Kindly build this in single query.</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754419#M119765</link>
      <description>&lt;P&gt;I can confirm the search produces the results shown.&amp;nbsp; I cannot verify these are the right results because you have said what the desired results are.&amp;nbsp; Nor can I test the search myself because the query is in a screenshot rather than in a code box.&lt;/P&gt;</description>
      <pubDate>Thu, 16 Oct 2025 14:46:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754419#M119765</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2025-10-16T14:46:46Z</dc:date>
    </item>
    <item>
      <title>Re: Kindly build this in single query.</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754430#M119767</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;&lt;P&gt;Could any one please help me in correcting the macros to get the ranking logic.&lt;BR /&gt;&lt;BR /&gt;defination :&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;| eval $score_field$ = tonumber($score_field$)&lt;BR /&gt;| stats avg($score_field$) AS avg_score by $class_field$&lt;BR /&gt;| sort - avg_score&lt;BR /&gt;| streamstats count AS rank&lt;BR /&gt;| eval avg_score = round(avg_score,2)&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="macros.png" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/40570iFC6EF3C97E16454F/image-size/large?v=v2&amp;amp;px=999" role="button" title="macros.png" alt="macros.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;thanks..&lt;/P&gt;</description>
      <pubDate>Fri, 17 Oct 2025 11:02:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754430#M119767</guid>
      <dc:creator>_Raj</dc:creator>
      <dc:date>2025-10-17T11:02:11Z</dc:date>
    </item>
    <item>
      <title>Re: Kindly build this in single query.</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754432#M119768</link>
      <description>&lt;P&gt;Change the name field to "class_ranking(2)".&amp;nbsp; The number of Arguments must be included in the macro name (unless there are no arguments).&lt;/P&gt;</description>
      <pubDate>Fri, 17 Oct 2025 12:06:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754432#M119768</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2025-10-17T12:06:50Z</dc:date>
    </item>
    <item>
      <title>Re: Kindly build this in single query.</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754467#M119774</link>
      <description>&lt;P&gt;Hello,&lt;/P&gt;&lt;P&gt;|makeresults format=csv data="student_id,student_name,class,school,subject,score&lt;BR /&gt;1,Alice,10A,School1,Math,85&lt;BR /&gt;2,Bob,10A,School1,Math,72&lt;BR /&gt;3,Charlie,10B,School1,Science,90&lt;BR /&gt;4,David,10A,School2,Math,65&lt;BR /&gt;5,Eva,10B,School2,Science,88"&lt;BR /&gt;| top score class school&lt;BR /&gt;| streamstats count as ClassLevel by class&lt;BR /&gt;| streamstats count as SchoolLevel by school&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thank You!&lt;/P&gt;</description>
      <pubDate>Sun, 19 Oct 2025 21:03:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Kindly-build-this-in-single-query/m-p/754467#M119774</guid>
      <dc:creator>vjdev</dc:creator>
      <dc:date>2025-10-19T21:03:49Z</dc:date>
    </item>
  </channel>
</rss>

