Splunk Search

How to sort groups by group total

vtalanki
Path Finder

Hi,

I want to display the count of occurrences of logline* for each user per date but sort the groups by total count

My data is something like:

user1 10/10/2019 logline1
user1 10/10/2019 logline2
user1 10/10/2019 logline3
user1 10/11/2019 logline4
user1 10/11/2019 logline5
user2 10/10/2019 logline6
user2 10/11/2019 logline1
user2 10/11/2019 logline2
user2 10/11/2019 logline3
user2 10/11/2019 logline4
user2 10/12/2019 logline5
user2 10/13/2019 logline6
user2 10/13/2019 logline7
user3 10/10/2019 logline1
user3 10/10/2019 logline2
user3 10/11/2019 logline3
user3 10/11/2019 logline4
user3 10/12/2019 logline5
user3 10/12/2019 logline6
user3 10/12/2019 logline7

I want to display the results like:

user2 10/10/2019 1
10/11/2019 4
10/12/2019 1
10/13/2019 2
user3 10/10/2019 2
10/11/2019 2
10/12/2019 3
user1 10/10/2019 3
10/11/2019 2

Here user2 has total 10 entries, user3 has 7 and user1 has 5. so the output should be sorted that way.

0 Karma

sandeepmakkena
Contributor
| eval Mdate = strftime(_time, "%Y-%m-%d") 
| stats count by user,Mdate
| stats values(Mdate), values(count) by user
| sort -values(c)

hope this helps, Thanks!

0 Karma

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval raw="user1 10/10/2019 logline1
user1 10/10/2019 logline2
user1 10/10/2019 logline3
user1 10/11/2019 logline4
user1 10/11/2019 logline5
user2 10/10/2019 logline6
user2 10/11/2019 logline1
user2 10/11/2019 logline2
user2 10/11/2019 logline3
user2 10/11/2019 logline4
user2 10/12/2019 logline5
user2 10/13/2019 logline6
user2 10/13/2019 logline7
user3 10/10/2019 logline1
user3 10/10/2019 logline2
user3 10/11/2019 logline3
user3 10/11/2019 logline4
user3 10/12/2019 logline5
user3 10/12/2019 logline6
user3 10/12/2019 logline7"
| makemv delim="
" raw
| mvexpand raw
| rename raw AS _raw
| rex "^(?<user>\S+)\s+(?<date>\S+)\s+(?<logline>\S+)$"
| eval _time = strptime(date, "%m/%d/%Y")
| sort 0 - _time

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| bin _time span=1d
| eval time = strftime(_time, "%m/%d/%Y")
| stats count BY user time
| stats list(time) AS time list(count) AS count BY user
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...