Splunk Search

How to count the the number of elements in a fields after performing a set difference against other events?

doksu
SplunkTrust
SplunkTrust

How could the number of elements in a tuple of fields be counted after performing a set difference against the other events?

A trivial example:

Fields: user, src, dest, app
EventA: (alice, host1, host3, sso)
EventB: (alice, host2, host3, sshd)
EventC: (alice, host1, host3, sshd)

The set difference of EventA and the other two events above would be the set: (sso) with a count of 1.

Using an imaginary stats function, it might look something like this:

... | eventstats setdiff(src dest app) as difference by user | eval count=mvcount(difference)

woodcock
Esteemed Legend

Is this close enough?

 ... | eventstats mode(*) AS mode_* BY user | eval deviant_src=if((src==mode_src),null(),src) | eval deviant_dest=if((dest==mode_dest),null(),dest) | eval deviant_app=if((app==mode_app),null(),app) | stats values(deviant*) count(deviant*) BY user
0 Karma

doksu
SplunkTrust
SplunkTrust

Thanks for your answer woodcock. It's quite close and a really interesting answer but it looks like it would only apply the operation to the most common element for each field. Maybe I should submit an RFE?

0 Karma

woodcock
Esteemed Legend

Are you sure the answer to your example shouldn't be: (host2,sso)?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...