Splunk Search

How to group events, subtract earliest rank from latest rank per user, and track value change over time?

amoulkaf
Engager

Hello,

Each event represents a user state and every user has rank.

data look as follow :

time rank user
time1 30 2
time1 50 1
time2 25 2
time2 51 1

 

Any idea on how to group events by time, and subtract the earliest rank from the latest rank for each user?

M

Labels (2)
0 Karma
1 Solution

thambisetty
Super Champion

 

| stats earliest(rank) as earliest_rank latest(rank) as latest_rank by user 
| eval final_rank = latest_rank-earliest_rank
| table user final_rank

 

————————————
If this helps, give a like below.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Have you more than two times/ranks for particular user and are there at least two ranks per user?

r. Ismo

0 Karma

amoulkaf
Engager

Yes, same user can have more than two times/ranks.
Solution sugjested byt thambisetty takes that into account and works perfectly.
Thanks

 

 

0 Karma

thambisetty
Super Champion

 

| stats earliest(rank) as earliest_rank latest(rank) as latest_rank by user 
| eval final_rank = latest_rank-earliest_rank
| table user final_rank

 

————————————
If this helps, give a like below.

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!