Splunk Search

How to group events, subtract earliest rank from latest rank per user, and track value change over time?

amoulkaf
Engager

Hello,

Each event represents a user state and every user has rank.

data look as follow :

time rank user
time1 30 2
time1 50 1
time2 25 2
time2 51 1

 

Any idea on how to group events by time, and subtract the earliest rank from the latest rank for each user?

M

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

 

| stats earliest(rank) as earliest_rank latest(rank) as latest_rank by user 
| eval final_rank = latest_rank-earliest_rank
| table user final_rank

 

————————————
If this helps, give a like below.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Have you more than two times/ranks for particular user and are there at least two ranks per user?

r. Ismo

0 Karma

amoulkaf
Engager

Yes, same user can have more than two times/ranks.
Solution sugjested byt thambisetty takes that into account and works perfectly.
Thanks

 

 

0 Karma

thambisetty
SplunkTrust
SplunkTrust

 

| stats earliest(rank) as earliest_rank latest(rank) as latest_rank by user 
| eval final_rank = latest_rank-earliest_rank
| table user final_rank

 

————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...