Splunk Search

Chronological Eventcount Per User

HeinzWaescher
Motivator

Hi,

is it possible to a add field to each event and add a value to this field, that shows the chronological count of the specific event per user? Let's call this field "eventserial".

So that the first event per user (the event per user with the earliest timestamp) has an eventserial of "1". The second event of the users lifecycle has an eventserial of "2", and so on.

Thanks in advance

Heinz

Tags (1)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

So you can try this:

your_search | streamstats count as "eventserial" by user | timechart span=5m max(eventserial) by user

This will assign the first event seen with a value of 1, and then increment by user as it pulls in more events. Then the timechart is just showing that the values increase by user as time decreases.

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

So you can try this:

your_search | streamstats count as "eventserial" by user | timechart span=5m max(eventserial) by user

This will assign the first event seen with a value of 1, and then increment by user as it pulls in more events. Then the timechart is just showing that the values increase by user as time decreases.

HeinzWaescher
Motivator

great, seems to work 🙂
thanks a lot

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

You can try: your_search | reverse | streamstats count as "eventserial" by user Streamstats will do the count based on how the events are streaming in from the indexers.

HeinzWaescher
Motivator

thanks for your post. this seems to add the value of 1 to the most recent event. can we change the search to add the value 1 to the "oldest" event?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...