Splunk Search

How to count min max time by user?

t874560
New Member

Hello,

I am trying to pull min and max time for each user:

index="iptv_rdkb" [|inputlookup usersfile.csv]
| fields _time Source device.make model userId
| stats count by Source make model userId _time
| eventstats max(_time) AS max min(_time) AS min
| eval max=strftime(max, "%Y/%m/%d %T.%3Q")
| eval min=strftime(min, "%Y/%m/%d %T.%3Q")
| stats earliest(min) as min earliest(max) as max first(make) as make first(model) as model first(userId) as user by userId

Results:

Source min max make model userid
b661834 2020-04-10 2020/04/10 TECHN xyz 1
b654623 2020-04-10 2020/04/10 TECHN xyz 2
b637895 2020-04-10 2020/04/10 TECHN xyz 3

This search gives me the same time for each record. For example, if minimum time is 2020-04-10 in any of the records, it will give this date/time in every record instead of giving min-max of that specific user.

I need min and max for each specific user.

Please help.

0 Karma

Vijeta
Influencer

@t874560 Use this search

 index="iptv_rdkb" [|inputlookup usersfile.csv]
 | fields _time Source device.make model userId
 | stats count by Source make model userId _time
 | eventstats max(_time) AS max min(_time) AS min by userId
 | eval max=strftime(max, "%Y/%m/%d %T.%3Q")
 | eval min=strftime(min, "%Y/%m/%d %T.%3Q")
 | stats earliest(min) as min earliest(max) as max first(make) as make first(model) as model first(userId) as user by userId
0 Karma

to4kawa
Ultra Champion

eventstats can use by clause.

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...