topic How to return items dependent on occurrence in Splunk Search

How to return items dependent on occurrence

steffen1 — Mon, 04 Nov 2019 12:42:26 GMT

I have the data field "user" with data like:
user1, user1, user2, user2, user3, user3, user3, ...

How do I get/count all items with an occurrence < 3?

Steffen

gcusello — Mon, 04 Nov 2019 16:10:51 GMT

Hi steffen1,
you have only one user value for each event or do you have more values in each event?
if the first, try something like this:

index=my_index
| stats count BY user
| where count<3

Ciao.
Giuseppe

woodcock — Mon, 04 Nov 2019 16:28:55 GMT

Assuming you are talking about data inside single events (otherwise you can use the answer by @gcusello), like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourctype="AndSourcetypeToo"
| makemv delim="," user

And then either:

| where mvcount(user)<3

Or:

| where mvcount(mvdedup(user))<3

steffen1 — Tue, 05 Nov 2019 07:10:42 GMT

But how to count this users? Do I have to save it to a variable first?

steffen1 — Tue, 05 Nov 2019 07:15:29 GMT

Sorry, but every user/username is in one event. In the end I want to count the occurrences of this names. Thank you!