Splunk Search

How to prioritize one entry over another in search?

DaveBunn
Path Finder

SO I have a data set

User      Vehicle

User_a    Car
User_b    Car
User_a    MotorBike
User_c    MotorBike
User_d    Car
User_c    Bicycle
User_a    Bicycle
User_c    Scooter
User_e    Car

What I need is to be able to run a search against this type of dataset and pull out only one return per username based upon those with a CAR, then Motorbike, then bicycle then scooter.

But I only need ONE return for any given user - if they have all four - based upon priority they are reported as a car owner.  If they only have two or three of the four, they only get reported as the owner of the highest priority vehicle.

I'm currently doing a search cars, score 1pt, append motobike score 2pt, and so on but that is slow on a big datasaet.

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval vehicle_score=case(Vehicle="Car",1,Vehicle="MotorBike",2,Vehicle="Bicycle",3,Vehicle="Scooter",4)
| stats min(vehicle_score) as vehicle_score by User
| eval Vehicle=case(vehicle_score=1,"Car",vehicle_score=2,"MotorBike",vehicle_score=3,"Bicycle",vehicle_score=4,"Scooter")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval vehicle_score=case(Vehicle="Car",1,Vehicle="MotorBike",2,Vehicle="Bicycle",3,Vehicle="Scooter",4)
| stats min(vehicle_score) as vehicle_score by User
| eval Vehicle=case(vehicle_score=1,"Car",vehicle_score=2,"MotorBike",vehicle_score=3,"Bicycle",vehicle_score=4,"Scooter")
0 Karma

DaveBunn
Path Finder

Thanks - simple when you think about it, I was doing a similar thing but allocating a score as I appended each loading, then score<= the results.
But this is eloquent - Thanks implemented and working perfectly

 

0 Karma

jami7
Loves-to-Learn Lots

I'd eval a var with the point values in a case statement car highest number and so on. Then I'd stat the results of the search max(value) by user, afterward you could then eval a new field with the text values based on the number returned in the max(value). Might not be efficient but would be easy to read and keep updated if new vehicle types are added. 

0 Karma
Get Updates on the Splunk Community!

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...