Getting Data In

How can I filter by the first encountered combination of values?

rposky
Engager

I have results in the following form and would like to filter for only those results matching a session_id=x and an object_id=y, or those first encountered in the results. Any ideas?

Session_Id | Object_Id
x | y
x | y
x | z
x | z
x | z
a | b
a | b
a | c

The expected output would be the events outlined in the following table, in which all events matching the first combination of session_id, object_id are allowed, when grouping by session_id.

Session_Id | Object_Id
x | y
x | y
a | b
a | b

0 Karma
1 Solution

somesoni2
Revered Legend

I hope the last row in expected output is a | c. With that try this

Your current query giving current result with field Session_Id,  Object_Id | streamstats count as rank by Session_Id | where (Session_Id="x" AND Object_Id="y") OR rank=1 | fields - rank

View solution in original post

somesoni2
Revered Legend

I hope the last row in expected output is a | c. With that try this

Your current query giving current result with field Session_Id,  Object_Id | streamstats count as rank by Session_Id | where (Session_Id="x" AND Object_Id="y") OR rank=1 | fields - rank

rposky
Engager

Thank you very much. That has led me in the right direction. I do want to filter out the a | c value, which I've been able to do now by applying stream stats to both fields, and then taking their difference. Any non-zero value would then indicate the items I would like to filter out.

streamstats count as session_rank by session_id | streamstats count as object_rank by object_id | eval request_rank=(session_rank-object_rank)
0 Karma

somesoni2
Revered Legend

If these are the results, what is the expected output?

0 Karma

rposky
Engager

I have edited the post, hopefully addressing your question.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...