Splunk Search

How can I group and aggregate and filter all events based on those aggregated attributes?

cjoelly
Loves-to-Learn

Coming from SQL, I want to do stuff like GROUP BY and HAVING ...

The data is available with a transaction identifier.Grouing should be done by that transaction identifier.

Per transaction, I want to check a few attributes, if their values are unique within each treansaction.

In SQL terms:
select transaction_id from index group by transaction_id

having count(distinct attr1) = 1 and count(distinct attr2) = 1 and count(distinct attr3) = 1

From that table of transaction_ids, a join to the same index should be done to filter the events.

How can I achieve this with Splunk query?

 

Labels (1)
0 Karma

cjoelly
Loves-to-Learn

We changed our approach, generate a different structure in Splunk using stats and thus we do not need to read the raw events anymore.

 

0 Karma

cjoelly
Loves-to-Learn

I dont know if my approach is the right way to go. As I learned, that JOINs allow only 50.000 records to be joined. And I expect way more events to be joined to the filtered transactions.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try using eventstats to tag each event with the aggregated value for the transaction it is a part of and use this to filter the events.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...