Splunk Search

How do I get unique within each group?

msg4sunil
Path Finder

Team,

Can you please help me with the splunk query for the below?

Thank you

Splunk query returns the below

1
1
1
2
2
2
3
1
1
3
1

How do I get the below( unique within each group)?

1
2
3
1

 

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index=*
| table sourcetype
| streamstats current=f window=2 last(sourcetype) as previous_sourcetype
| where sourcetype != previous_sourcetype

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

How did you get this result?

Why is 1 still repeated in your required result?

0 Karma

msg4sunil
Path Finder

Since I wanted to know the flow of data from one sourcetype to another sourcetype.  Apparently, in my case, the data after existing a sourcetype can re enter the sourcetype at a later point of time.

Thank you

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @msg4sunil 

use

values(fieldname1) by fieldname2

0 Karma

msg4sunil
Path Finder

@SanjayReddy 

Can you please clarify as how do I use 

values(fieldname1) by fieldname2?

 
My original query is 
index=*|table sourcetype
 
Thank you
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=*|table sourcetype|dedup sourcetype
0 Karma

msg4sunil
Path Finder

Sorry, I cant be using dedup, since that doesn't solve my purpose.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=*
| table sourcetype
| streamstats current=f window=2 last(sourcetype) as previous_sourcetype
| where sourcetype != previous_sourcetype

msg4sunil
Path Finder

Wow. Amazing. Thanks a lot!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...