Find unique person count in Splunk

[freephoneid]

I've below line in my logs:

INFO #add-person# #new# personId=12 isGroupMember=true
INFO #remove-person# #remove# personId=1 isGroupMember=true
INFO #add-person# #new# personId=13 isGroupMember=false
INFO #add-person# #new# personId=12 isGroupMember=true
INFO #add-person# #new# personId=14 isGroupMember=true
INFO #add-person# #new# personId=15 isGroupMember=true

Log has all other lines as well which I did not show here.

I need to write the query which will give me the count of all persons who are added newly & who are group members. So basically I'm looking for "#add-person# #new# isGroupMember=true" for unique personIds.

For above input, the output should be 3 as there are 3 unique personIds with grupmembership set to true and who are having tag "#add-person# #new#"

How can I do it with Splunk query?

Thanks!

[lguinn2 · Accepted solution]

Try this

"#add-person#"  "#new#" isGroupMember=true
| stats dc(personId) as NewMembersCount

For more details, you could do this

"#add-person#"  "#new#" isGroupMember=true
| stats dc(personId) as NewMembersCount values(personId) as "New Member Ids"

[lguinn2]

mbenwell is right - the order of terms is not important. The search in my answer has three different and independent terms.

[mbenwell]

lguinn's search will return every record that contains #add-person#, #new# and has isGroupMember set to true.

If you surrounded the entire string in quotes (i.e. "#add-person# #new# isGroupMember-true") then no, it wouldn't match anything, because it would literally search for that string. But that is not what lguinn has given you.

In lguinn's example, both strings have been quoted, so it will match each individual string regardless of order.

If you're not sure if the search is right, run the search without the stats command and see what results you get back.

[freephoneid]

Hi, In your query, you're looking for "#add-person#" "#new#" isGroupMember=true but I believe this first part itself will not return any results as the personId= string is present in between. When we search in Splunk, it'll look for strings in order, right? If so, the first part itself won't return any results. Can you please comment?

[mbenwell]

The first part of your search should be to match just the log events you are interested in (isGroupMember=true, add-person new...).

Then look into the stats command