Getting Data In

How can I filter by the first encountered combination of values?

rposky
Engager

I have results in the following form and would like to filter for only those results matching a session_id=x and an object_id=y, or those first encountered in the results. Any ideas?

Session_Id | Object_Id
x | y
x | y
x | z
x | z
x | z
a | b
a | b
a | c

The expected output would be the events outlined in the following table, in which all events matching the first combination of session_id, object_id are allowed, when grouping by session_id.

Session_Id | Object_Id
x | y
x | y
a | b
a | b

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

I hope the last row in expected output is a | c. With that try this

Your current query giving current result with field Session_Id,  Object_Id | streamstats count as rank by Session_Id | where (Session_Id="x" AND Object_Id="y") OR rank=1 | fields - rank

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

I hope the last row in expected output is a | c. With that try this

Your current query giving current result with field Session_Id,  Object_Id | streamstats count as rank by Session_Id | where (Session_Id="x" AND Object_Id="y") OR rank=1 | fields - rank

rposky
Engager

Thank you very much. That has led me in the right direction. I do want to filter out the a | c value, which I've been able to do now by applying stream stats to both fields, and then taking their difference. Any non-zero value would then indicate the items I would like to filter out.

streamstats count as session_rank by session_id | streamstats count as object_rank by object_id | eval request_rank=(session_rank-object_rank)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

If these are the results, what is the expected output?

0 Karma

rposky
Engager

I have edited the post, hopefully addressing your question.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...