Splunk Search

Get unique count by matching partial attributes in log

freephoneid
Path Finder

Hi,

I want to find out how many users have blue colors & how many of them have red color for all unique users?

[2011-09-30 18:15:01:559 GMT+00:00][137D3B5A5F196F81A405858E6A5AA01F.maps-358-thread-1][com.abc.myaction.myfilter] INFO email=abc@hotmail.com userid=1234
[2011-09-30 18:15:01:559 GMT+00:00][237D3B5A5F197F81A405858E6A5AA0WD.maps-158-thread1][com.abc.myaction.myfilter] INFO email=pqr@rff.com userid=4235
[2011-09-30 18:15:01:559 GMT+00:00][337D3B5A5F198F81A405858E6A5AA0GW.maps-258-thread-1][com.abc.myaction.myfilter] INFO email=xyz@abc.com userid=7645
[2011-09-30 18:14:58:768 GMT+00:00][237D3B5A5F198F81A405858E6A5AA09F.http-8080-11][com.pqr.abclogging.mywrapper] DEBUG redColor=true blueColor=false
[2011-09-30 18:14:58:768 GMT+00:00][237D3B5A5F197F81A405858E6A5AA0WD.http-8080-11][com.fff.filter] DEBUG redColor=true blueColor=false
[2011-09-30 18:14:58:768 GMT+00:00][137D3B5A5F196F81A405858E6A5AA01F.http-8080-11][com.xyz.wrapper] DEBUG redColor=false blueColor=true
[2011-09-30 18:14:58:768 GMT+00:00][337D3B5A5F198F81A405858E6A5AA0GW.http-8080-11][com.xyz.wrapper] DEBUG redColor=false blueColor=true

In above log, I've to get all distinct users & then for each user, I need to get their session id & them match it within the line that contains the DEBUG & check if redColor=true or not.

So, in above case, the output should be:

No of users with red color = 1 (Note: 237D3B5A5F198F81A405858E6A5AA09F does not match with anything, hence not counted even though its red flag is true)
No of users with blue color = 2

Is this possible within splunk?

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Something like

... | stats count(eval(redColor=="true")) as redcount
            count(eval(blueColor=="true")) as bluecount
            first(userid) as userid by sessionid 
    | stats sum(redcount), sum(bluecount) by userid

would do it.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Something like

... | stats count(eval(redColor=="true")) as redcount
            count(eval(blueColor=="true")) as bluecount
            first(userid) as userid by sessionid 
    | stats sum(redcount), sum(bluecount) by userid

would do it.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...