Splunk Search

How to group events, subtract earliest rank from latest rank per user, and track value change over time?

amoulkaf
Engager

Hello,

Each event represents a user state and every user has rank.

data look as follow :

time rank user
time1 30 2
time1 50 1
time2 25 2
time2 51 1

 

Any idea on how to group events by time, and subtract the earliest rank from the latest rank for each user?

M

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

 

| stats earliest(rank) as earliest_rank latest(rank) as latest_rank by user 
| eval final_rank = latest_rank-earliest_rank
| table user final_rank

 

————————————
If this helps, give a like below.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Have you more than two times/ranks for particular user and are there at least two ranks per user?

r. Ismo

0 Karma

amoulkaf
Engager

Yes, same user can have more than two times/ranks.
Solution sugjested byt thambisetty takes that into account and works perfectly.
Thanks

 

 

0 Karma

thambisetty
SplunkTrust
SplunkTrust

 

| stats earliest(rank) as earliest_rank latest(rank) as latest_rank by user 
| eval final_rank = latest_rank-earliest_rank
| table user final_rank

 

————————————
If this helps, give a like below.
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...