topic Re: dedup on Field over time span in Splunk Search

dedup on Field over time span

triva79 — Mon, 20 May 2024 13:27:15 GMT

we have data in Splunk for user sessions in an app and I am trying to produce a line graph to show usage every hour. the session information is added 4 times an hour so trying to remove the extra results per hour

below is an example for one user but there will be other user data as well

userName: fred
sessionKey: a0b360d9-a471-45a1-9dcc-0dee39ed6ba8
timestamp: 2024-05-20T12:00:00Z

userName: fred
sessionKey: a0b360d9-a471-45a1-9dcc-0dee39ed6ba8
timestamp: 2024-05-20T12:30:00Z

userName: fred
sessionKey: a0b360d9-a471-45a1-9dcc-0dee39ed6ba8
timestamp: 2024-05-20T12:45:00Z

userName: fred
sessionKey: a0b360d9-a471-45a1-9dcc-0dee39ed6ba8
timestamp: 2024-05-20T13:00:00Z

Re: dedup on Field over time span

gcusello — Mon, 20 May 2024 13:34:20 GMT

Hi @triva79,

you could use timechart or dedup:

<your_search> | timechart span=1h count BY userName

Ciao.

Giuseppe

Re: dedup on Field over time span

ITWhisperer — Mon, 20 May 2024 13:39:38 GMT

The session is only present 3 times in the hour, the fourth one at 13:00 is in the next hour

Anyway, assuming you still want to count different sessions for the same user separately, you can do the stats twice

| bin _time span=1h | stats count by _time, userName, sessionKey | stats count by _time, userName

Depending on what count you actually want, you could also do this

| bin _time span=1h | stats count by _time, userName, sessionKey | stats count by _time

Re: dedup on Field over time span

bandit — Mon, 20 May 2024 15:53:23 GMT

@triva79

How about...

| timechart span=1h limit=50 useother=false dc(userName) as count by userName

or maybe...

| eval session=userName+":"+sessionKey | timechart span=1h limit=50 useother=false dc(session) as count by session

Re: dedup on Field over time span

triva79 — Mon, 20 May 2024 14:52:59 GMT

thanks so much 🙂 only my 2nd day using Splunk

Re: dedup on Field over time span

gcusello — Mon, 20 May 2024 15:38:14 GMT

Hi @triva79 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉