topic Re: How do I use a large input in a query? in Splunk Search

How do I use a large input in a query?

trunghung — Sat, 09 Apr 2016 01:23:20 GMT

I am try to write some query[ies] so that I find user who had done action A AFTER they did action B . the time span is simply too long to use transaction command. Previously when I used to run a query for userid who did action A (the smaller set of the 2), manually make that list into a giant (userid1 OR userid2) and search for users who did action B. This would work when the output from action A was around 10k id. Now I have to do thing same thing, except the the number of user now increase to the hundreds of thousand range too impractical to do the manual approach. I tried using subsearch but that doesn't work well with large input data. can someone suggest a solution that scale well? thanks

Re: How do I use a large input in a query?

sundareshr — Sat, 09 Apr 2016 14:52:34 GMT

Have you tried something like this

index=eventA OR index=eventB action=A or action=B | chart count over user by action | where actionA>0 AND actionB>0

Re: How do I use a large input in a query?

woodcock — Sat, 09 Apr 2016 18:16:32 GMT

Try this:

(index=eventA OR index=eventB) (action="A" OR action="B") | streamstats count(eval(action="A")) AS SessionID BY user | sort SessionID user

Re: How do I use a large input in a query?

trunghung — Sat, 09 Apr 2016 18:47:27 GMT

sorry I left out an important part of the question, I need to find the userID of those who did action A AFTER they did action B. your query wont' work. thanks you for your help though

Re: How do I use a large input in a query?

trunghung — Sat, 09 Apr 2016 18:47:43 GMT

sorry I left out an important part of the question, I need to find the userID of those who did action A AFTER they did action B. your query wont' work. thanks you for your help though

Re: How do I use a large input in a query?

sundareshr — Mon, 11 Apr 2016 18:39:16 GMT

Try this

index=eventA OR index=eventB action=A or action=B | stats latest(eval(if(action="A", _time, null()))) as a latest(eval(if(action="B", _time, null()))) as b by userid | where a>b

Re: How do I use a large input in a query?

woodcock — Thu, 28 Apr 2016 15:08:58 GMT

OK, try this:

(index=eventA OR index=eventB) (action="A" OR action="B") | streamstats count(eval(action="A")) AS SessionID BY user userID | sort SessionID user userID