Getting Data In

Conditional Aggregate- How to search all entityID's with count?

bmer
Observer

I have below splunk which gets me all entityID's with count

index=coreprod pod=xxxx CASE(xxxxxx) event=ack |stats count by entityId |where count>1

I want to list ONLY those entityID's where the difference between their occurrence is less than 1hr (0r xx min

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=coreprod pod=xxxx CASE(xxxxxx) event=ack earliest=-1h | stats count by entityId |where count>1
0 Karma

bmer
Observer

Thanks @ITWhisperer But this is ONLY for LAST 1h. I want to pull all output of YESTERDAY and see within that how many  duplicate events had a gap of 1h or 30m or xx

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean something like this?

index=coreprod pod=xxxx CASE(xxxxxx) event=ack
| streamstats range(_time) as range global=f window=2 by entityId
| where range < 3600
| stats count
0 Karma

bmer
Observer

@ITWhisperer Let me try explaining with an example.My original splunk gives below output for YESTERDAY.I know that A2 and A3 event occurred within a span of 30min whereas BOTH the A1 events occurred within a gap of 2h

entityIdCount
A12
A22
A33

 

Iam trying to see (using splunk) if there is some way to list ONLY for YESTERDAY since these 2 records fulfil the criteria of having occurred within 30min 

 

entityIdCount
A22
A33
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| sort 0 _time
| streamstats range(_time) as range window=2 global=f by entityId
| eval range=if(range > 0,range,null())
| eventstats min(range) as range by entitiyId
| where range < 1800
| stats count by entityId
| eval count = count + 1
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...