topic How can I filter by the first encountered combination of values? in Getting Data In

How can I filter by the first encountered combination of values?

rposky — Mon, 28 Sep 2020 19:09:08 GMT

I have results in the following form and would like to filter for only those results matching a session_id=x and an object_id=y, or those first encountered in the results. Any ideas?

Session_Id | Object_Id
x | y
x | y
x | z
x | z
x | z
a | b
a | b
a | c

The expected output would be the events outlined in the following table, in which all events matching the first combination of session_id, object_id are allowed, when grouping by session_id.

Session_Id | Object_Id
x | y
x | y
a | b
a | b

Re: How can I filter by the first encountered combination of values?

somesoni2 — Wed, 11 Mar 2015 19:46:39 GMT

If these are the results, what is the expected output?

Re: How can I filter by the first encountered combination of values?

rposky — Wed, 11 Mar 2015 19:55:35 GMT

I have edited the post, hopefully addressing your question.

Re: How can I filter by the first encountered combination of values?

somesoni2 — Wed, 11 Mar 2015 20:30:27 GMT

I hope the last row in expected output is a | c. With that try this

Your current query giving current result with field Session_Id,  Object_Id | streamstats count as rank by Session_Id | where (Session_Id="x" AND Object_Id="y") OR rank=1 | fields - rank

Re: How can I filter by the first encountered combination of values?

rposky — Wed, 11 Mar 2015 20:53:42 GMT

Thank you very much. That has led me in the right direction. I do want to filter out the a | c value, which I've been able to do now by applying stream stats to both fields, and then taking their difference. Any non-zero value would then indicate the items I would like to filter out.

streamstats count as session_rank by session_id | streamstats count as object_rank by object_id | eval request_rank=(session_rank-object_rank)