Splunk Search

Get unique count by matching partial attributes in log

freephoneid
Path Finder

Hi,

I want to find out how many users have blue colors & how many of them have red color for all unique users?

[2011-09-30 18:15:01:559 GMT+00:00][137D3B5A5F196F81A405858E6A5AA01F.maps-358-thread-1][com.abc.myaction.myfilter] INFO email=abc@hotmail.com userid=1234
[2011-09-30 18:15:01:559 GMT+00:00][237D3B5A5F197F81A405858E6A5AA0WD.maps-158-thread1][com.abc.myaction.myfilter] INFO email=pqr@rff.com userid=4235
[2011-09-30 18:15:01:559 GMT+00:00][337D3B5A5F198F81A405858E6A5AA0GW.maps-258-thread-1][com.abc.myaction.myfilter] INFO email=xyz@abc.com userid=7645
[2011-09-30 18:14:58:768 GMT+00:00][237D3B5A5F198F81A405858E6A5AA09F.http-8080-11][com.pqr.abclogging.mywrapper] DEBUG redColor=true blueColor=false
[2011-09-30 18:14:58:768 GMT+00:00][237D3B5A5F197F81A405858E6A5AA0WD.http-8080-11][com.fff.filter] DEBUG redColor=true blueColor=false
[2011-09-30 18:14:58:768 GMT+00:00][137D3B5A5F196F81A405858E6A5AA01F.http-8080-11][com.xyz.wrapper] DEBUG redColor=false blueColor=true
[2011-09-30 18:14:58:768 GMT+00:00][337D3B5A5F198F81A405858E6A5AA0GW.http-8080-11][com.xyz.wrapper] DEBUG redColor=false blueColor=true

In above log, I've to get all distinct users & then for each user, I need to get their session id & them match it within the line that contains the DEBUG & check if redColor=true or not.

So, in above case, the output should be:

No of users with red color = 1 (Note: 237D3B5A5F198F81A405858E6A5AA09F does not match with anything, hence not counted even though its red flag is true)
No of users with blue color = 2

Is this possible within splunk?

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Something like

... | stats count(eval(redColor=="true")) as redcount
            count(eval(blueColor=="true")) as bluecount
            first(userid) as userid by sessionid 
    | stats sum(redcount), sum(bluecount) by userid

would do it.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Something like

... | stats count(eval(redColor=="true")) as redcount
            count(eval(blueColor=="true")) as bluecount
            first(userid) as userid by sessionid 
    | stats sum(redcount), sum(bluecount) by userid

would do it.

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...