Splunk Search

Find unique person count in Splunk

freephoneid
Path Finder

I've below line in my logs:

INFO #add-person# #new# personId=12 isGroupMember=true
INFO #remove-person# #remove# personId=1 isGroupMember=true
INFO #add-person# #new# personId=13 isGroupMember=false
INFO #add-person# #new# personId=12 isGroupMember=true
INFO #add-person# #new# personId=14 isGroupMember=true
INFO #add-person# #new# personId=15 isGroupMember=true

Log has all other lines as well which I did not show here.

I need to write the query which will give me the count of all persons who are added newly & who are group members. So basically I'm looking for "#add-person# #new# isGroupMember=true" for unique personIds.

For above input, the output should be 3 as there are 3 unique personIds with grupmembership set to true and who are having tag "#add-person# #new#"

How can I do it with Splunk query?

Thanks!

0 Karma
1 Solution

lguinn2
Legend

Try this

"#add-person#"  "#new#" isGroupMember=true
| stats dc(personId) as NewMembersCount

For more details, you could do this

"#add-person#"  "#new#" isGroupMember=true
| stats dc(personId) as NewMembersCount values(personId) as "New Member Ids"

View solution in original post

0 Karma

lguinn2
Legend

Try this

"#add-person#"  "#new#" isGroupMember=true
| stats dc(personId) as NewMembersCount

For more details, you could do this

"#add-person#"  "#new#" isGroupMember=true
| stats dc(personId) as NewMembersCount values(personId) as "New Member Ids"
0 Karma

lguinn2
Legend

mbenwell is right - the order of terms is not important. The search in my answer has three different and independent terms.

0 Karma

mbenwell
Communicator

lguinn's search will return every record that contains #add-person#, #new# and has isGroupMember set to true.

If you surrounded the entire string in quotes (i.e. "#add-person# #new# isGroupMember-true") then no, it wouldn't match anything, because it would literally search for that string. But that is not what lguinn has given you.

In lguinn's example, both strings have been quoted, so it will match each individual string regardless of order.

If you're not sure if the search is right, run the search without the stats command and see what results you get back.

0 Karma

freephoneid
Path Finder

Hi, In your query, you're looking for "#add-person#" "#new#" isGroupMember=true but I believe this first part itself will not return any results as the personId= string is present in between. When we search in Splunk, it'll look for strings in order, right? If so, the first part itself won't return any results. Can you please comment?

0 Karma

mbenwell
Communicator

The first part of your search should be to match just the log events you are interested in (isGroupMember=true, add-person new...).

Then look into the stats command

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...