topic Re: show only unique values over timeseries data with stats in Splunk Search

How to only show only unique values over timeseries data with stats

mjones414 — Thu, 31 Mar 2022 21:18:28 GMT

I have a time series data source where an alert writes an event indicating that the number of systems an account is logging into is increasing over a set window of time. in each event series, it lists all the machines including the new one that the account incremented by in a multivalue field.

Broken out by day, I'm trying to only display the unique machines
e.g.
| stats values(IPS) as ips values(computer) as dvcs by user _time

I tried to accomplish this using mvdedup but that is only capable of deduping multi-value in a given event not a full timeseries search result. Would love any advise you may have to accomplish this

Re: show only unique values over timeseries data with stats

somesoni2 — Thu, 31 Mar 2022 20:41:14 GMT

Give this a try

Your current search giving fields _time user IPS computer | bucket span=1d _time | stats min(_time) as _time by user IPS computer | stats values(IPS) as ips values(computer) as dvcs by user _time

Re: show only unique values over timeseries data with stats

mjones414 — Fri, 01 Apr 2022 14:35:55 GMT

You, sir, are a true gentlemen and a scholar! Thank you so much!