Get unique count by matching partial attributes in log

freephoneid — Fri, 30 Sep 2011 18:35:32 GMT

Hi,

I want to find out how many users have blue colors & how many of them have red color for all unique users?

[2011-09-30 18:15:01:559 GMT+00:00][137D3B5A5F196F81A405858E6A5AA01F.maps-358-thread-1][com.abc.myaction.myfilter] INFO email=abc@hotmail.com userid=1234
[2011-09-30 18:15:01:559 GMT+00:00][237D3B5A5F197F81A405858E6A5AA0WD.maps-158-thread1][com.abc.myaction.myfilter] INFO email=pqr@rff.com userid=4235
[2011-09-30 18:15:01:559 GMT+00:00][337D3B5A5F198F81A405858E6A5AA0GW.maps-258-thread-1][com.abc.myaction.myfilter] INFO email=xyz@abc.com userid=7645
[2011-09-30 18:14:58:768 GMT+00:00][237D3B5A5F198F81A405858E6A5AA09F.http-8080-11][com.pqr.abclogging.mywrapper] DEBUG redColor=true blueColor=false
[2011-09-30 18:14:58:768 GMT+00:00][237D3B5A5F197F81A405858E6A5AA0WD.http-8080-11][com.fff.filter] DEBUG redColor=true blueColor=false
[2011-09-30 18:14:58:768 GMT+00:00][137D3B5A5F196F81A405858E6A5AA01F.http-8080-11][com.xyz.wrapper] DEBUG redColor=false blueColor=true
[2011-09-30 18:14:58:768 GMT+00:00][337D3B5A5F198F81A405858E6A5AA0GW.http-8080-11][com.xyz.wrapper] DEBUG redColor=false blueColor=true

In above log, I've to get all distinct users & then for each user, I need to get their session id & them match it within the line that contains the DEBUG & check if redColor=true or not.

So, in above case, the output should be:

No of users with red color = 1 (Note: 237D3B5A5F198F81A405858E6A5AA09F does not match with anything, hence not counted even though its red flag is true)
No of users with blue color = 2

Is this possible within splunk?

Re: Get unique count by matching partial attributes in log

gkanapathy — Fri, 30 Sep 2011 23:29:26 GMT

Something like

... | stats count(eval(redColor=="true")) as redcount
            count(eval(blueColor=="true")) as bluecount
            first(userid) as userid by sessionid 
    | stats sum(redcount), sum(bluecount) by userid

would do it.

topic Get unique count by matching partial attributes in log in Splunk Search

Get unique count by matching partial attributes in log

Re: Get unique count by matching partial attributes in log