Splunk Search

How can I group and aggregate and filter all events based on those aggregated attributes?

cjoelly
Loves-to-Learn

Coming from SQL, I want to do stuff like GROUP BY and HAVING ...

The data is available with a transaction identifier.Grouing should be done by that transaction identifier.

Per transaction, I want to check a few attributes, if their values are unique within each treansaction.

In SQL terms:
select transaction_id from index group by transaction_id

having count(distinct attr1) = 1 and count(distinct attr2) = 1 and count(distinct attr3) = 1

From that table of transaction_ids, a join to the same index should be done to filter the events.

How can I achieve this with Splunk query?

 

Labels (1)
0 Karma

cjoelly
Loves-to-Learn

We changed our approach, generate a different structure in Splunk using stats and thus we do not need to read the raw events anymore.

 

0 Karma

cjoelly
Loves-to-Learn

I dont know if my approach is the right way to go. As I learned, that JOINs allow only 50.000 records to be joined. And I expect way more events to be joined to the filtered transactions.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try using eventstats to tag each event with the aggregated value for the transaction it is a part of and use this to filter the events.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...