Splunk Search

In a search, Is there an alternative for the eventstats command?

patricianaguit
Explorer

I need to find another way instead of eventstats for my search.

Is there a way where I can tag the events and add another field based on hierarchy other than eventstats?

For example
Id 1 has different initial tags (A,B,C, and D) since A is the highest, the final tag should be "A"

ID   |                InitialTag               |  FinalTag
1                        A                            A
1                        B                            A
1                        C                            A
1                        D                            A

Tag Ranks:
A
B
C
D
0 Karma
1 Solution

harishalipaka
Motivator

hi @patricianaguit

Can you try this

you can use streamstats
or

 |stats values(InitalTag) by ID 
Thanks
Harish

View solution in original post

0 Karma

harishalipaka
Motivator

hi @patricianaguit

Can you try this

you can use streamstats
or

 |stats values(InitalTag) by ID 
Thanks
Harish
0 Karma

patricianaguit
Explorer

thank you!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...