topic Re: Group by id. in Splunk Search

Group by id.

sandeepmakkena — Sat, 09 Nov 2019 03:18:28 GMT

I have a query like this

  index=MyIndex 
    | stats values(status) as status by id, time
    | dedup id,status

Gives me something like this
Status id time
apply 123 2019-10-28 10:04:02.707 EST
verify 123 2019-10-28 10:04:07.767 EST
approved 123 2019-10-28 10:04:10.707 PDT
login 123 2019-10-28 10:04:12.707 PDT
but I want
id latest(time) Status
123. 2019-10-28 10:04:12.707 PDT apply, verify, approved login

I did try

stats values(status), latest(time) by id but, the problem is with values(status) they're getting sorted alphabetically.

Thanks for your time.

Re: Group by id.

bowesmana — Sat, 09 Nov 2019 06:31:01 GMT

Using

stats list(status) as status latest(time) by id
| eval status=mvjoin(mvdedup(status),",")

list does not sort the items, but it also reports all occurrences of status, so if there is more than one of a single status, it will list all, hence the mvdedup will dedup the duplicates without changing the order.

Re: Group by id.

woodcock — Sat, 09 Nov 2019 22:48:47 GMT

Try this:

index=MyIndex 
| stats max(_time) AS _time values(status) AS status BY id

Or perhaps this:

index=MyIndex 
| stats max(_time) AS _time BY status id

Re: Group by id.

sandeepmakkena — Mon, 11 Nov 2019 17:48:06 GMT

This is beautiful, Thanks!