Splunk Search

How to group events, subtract earliest rank from latest rank per user, and track value change over time?

amoulkaf
Engager

Hello,

Each event represents a user state and every user has rank.

data look as follow :

time rank user
time1 30 2
time1 50 1
time2 25 2
time2 51 1

 

Any idea on how to group events by time, and subtract the earliest rank from the latest rank for each user?

M

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

 

| stats earliest(rank) as earliest_rank latest(rank) as latest_rank by user 
| eval final_rank = latest_rank-earliest_rank
| table user final_rank

 

————————————
If this helps, give a like below.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Have you more than two times/ranks for particular user and are there at least two ranks per user?

r. Ismo

0 Karma

amoulkaf
Engager

Yes, same user can have more than two times/ranks.
Solution sugjested byt thambisetty takes that into account and works perfectly.
Thanks

 

 

0 Karma

thambisetty
SplunkTrust
SplunkTrust

 

| stats earliest(rank) as earliest_rank latest(rank) as latest_rank by user 
| eval final_rank = latest_rank-earliest_rank
| table user final_rank

 

————————————
If this helps, give a like below.
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...