Splunk Search

How can I group and aggregate and filter all events based on those aggregated attributes?

cjoelly
Loves-to-Learn

Coming from SQL, I want to do stuff like GROUP BY and HAVING ...

The data is available with a transaction identifier.Grouing should be done by that transaction identifier.

Per transaction, I want to check a few attributes, if their values are unique within each treansaction.

In SQL terms:
select transaction_id from index group by transaction_id

having count(distinct attr1) = 1 and count(distinct attr2) = 1 and count(distinct attr3) = 1

From that table of transaction_ids, a join to the same index should be done to filter the events.

How can I achieve this with Splunk query?

 

Labels (1)
0 Karma

cjoelly
Loves-to-Learn

We changed our approach, generate a different structure in Splunk using stats and thus we do not need to read the raw events anymore.

 

0 Karma

cjoelly
Loves-to-Learn

I dont know if my approach is the right way to go. As I learned, that JOINs allow only 50.000 records to be joined. And I expect way more events to be joined to the filtered transactions.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try using eventstats to tag each event with the aggregated value for the transaction it is a part of and use this to filter the events.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...