Splunk Search

How to group events, subtract earliest rank from latest rank per user, and track value change over time?

amoulkaf
Engager

Hello,

Each event represents a user state and every user has rank.

data look as follow :

time rank user
time1 30 2
time1 50 1
time2 25 2
time2 51 1

 

Any idea on how to group events by time, and subtract the earliest rank from the latest rank for each user?

M

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

 

| stats earliest(rank) as earliest_rank latest(rank) as latest_rank by user 
| eval final_rank = latest_rank-earliest_rank
| table user final_rank

 

————————————
If this helps, give a like below.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Have you more than two times/ranks for particular user and are there at least two ranks per user?

r. Ismo

0 Karma

amoulkaf
Engager

Yes, same user can have more than two times/ranks.
Solution sugjested byt thambisetty takes that into account and works perfectly.
Thanks

 

 

0 Karma

thambisetty
SplunkTrust
SplunkTrust

 

| stats earliest(rank) as earliest_rank latest(rank) as latest_rank by user 
| eval final_rank = latest_rank-earliest_rank
| table user final_rank

 

————————————
If this helps, give a like below.
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...