topic Re: field with exclusively one value in Splunk Search

field with exclusively one value

monika0511 — Thu, 15 Oct 2020 16:40:07 GMT

here is how my base search output looks:

name	version	browser	runTime
call1	alpha	chrome	75
call1	beta	chrome	48
call2	alpha	firefox	30
call2	beta	chrome	78
call3	beta	firefox	56

I'm looking for a distinct list of "name, browser" that exclusively belongs to "beta" version. Getting count and median values is a bonus.

Here is the desired output:

name	version	browser	count(runTime)	median(runTime)
call2	beta	chrome	1	30
call3	beta	firefox	1	56

This is what I have so far: But this only gives me a diff. It can return alpha calls if those are not present in beta version. I'm looking for ONLY beta calls.

baseSearch | stats dc(version) as found_in_versions BY name, platform | where found_in_versions < 2

Any help would be appreciated!

Re: field with exclusively one value

richgalloway — Thu, 15 Oct 2020 18:05:17 GMT

Filter the desired events in the base search or a where clause.

baseSearch version=beta | stats dc(version) as found_in_versions BY name, platform | where found_in_versions < 2

baseSearch | where version=beta | stats dc(version) as found_in_versions BY name, platform | where found_in_versions < 2

Re: field with exclusively one value

monika0511 — Thu, 15 Oct 2020 20:30:44 GMT

Here is how I was able to do it: