Getting Data In

Conditional Aggregate- How to search all entityID's with count?

bmer
Explorer

I have below splunk which gets me all entityID's with count

index=coreprod pod=xxxx CASE(xxxxxx) event=ack |stats count by entityId |where count>1

I want to list ONLY those entityID's where the difference between their occurrence is less than 1hr (0r xx min

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=coreprod pod=xxxx CASE(xxxxxx) event=ack earliest=-1h | stats count by entityId |where count>1
0 Karma

bmer
Explorer

Thanks @ITWhisperer But this is ONLY for LAST 1h. I want to pull all output of YESTERDAY and see within that how many  duplicate events had a gap of 1h or 30m or xx

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean something like this?

index=coreprod pod=xxxx CASE(xxxxxx) event=ack
| streamstats range(_time) as range global=f window=2 by entityId
| where range < 3600
| stats count
0 Karma

bmer
Explorer

@ITWhisperer Let me try explaining with an example.My original splunk gives below output for YESTERDAY.I know that A2 and A3 event occurred within a span of 30min whereas BOTH the A1 events occurred within a gap of 2h

entityIdCount
A12
A22
A33

 

Iam trying to see (using splunk) if there is some way to list ONLY for YESTERDAY since these 2 records fulfil the criteria of having occurred within 30min 

 

entityIdCount
A22
A33
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| sort 0 _time
| streamstats range(_time) as range window=2 global=f by entityId
| eval range=if(range > 0,range,null())
| eventstats min(range) as range by entitiyId
| where range < 1800
| stats count by entityId
| eval count = count + 1
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...