Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Compare results from day to day
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Let's assume I have data structured like this:
|timestamp|user|action|
|2019-09-10 13:40|user1|action1|
|2019-09-10 12:40|user2|action2|
|2019-09-09 12:40|user3|action3|
|2019-09-09 13:40|user1|action1|
|2019-09-09 12:40|user3|action4|
|2019-09-09 11:40|user1|action1|
|2019-09-09 09:40|user2|action2|
Now, I would like to search for events where users have performed the same actions, in this case, I would like to have these events in my search:
|2019-09-10 13:40|user1|action1|
|2019-09-09 13:40|user1|action1|
|2019-09-09 11:40|user1|action1|
|2019-09-10 12:40|user2|action2|
|2019-09-09 09:40|user2|action2|
I tried subsearches and selfjoin, but to no avail. In what direction should I look?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hopefully this will give you a new direction
|eval unique=user."".action
|stats dc(unique) as filter values(time) as time by user action |where filter>1 |sort user |fields - filter
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hopefully this will give you a new direction
|eval unique=user."".action
|stats dc(unique) as filter values(time) as time by user action |where filter>1 |sort user |fields - filter
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, this seems promising.
Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...
Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions
Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...
