Splunk Search

In a search, Is there an alternative for the eventstats command?

Explorer

I need to find another way instead of eventstats for my search.

Is there a way where I can tag the events and add another field based on hierarchy other than eventstats?

For example
Id 1 has different initial tags (A,B,C, and D) since A is the highest, the final tag should be "A"

ID   |                InitialTag               |  FinalTag
1                        A                            A
1                        B                            A
1                        C                            A
1                        D                            A

Tag Ranks:
A
B
C
D
0 Karma
1 Solution

hi @patricianaguit

Can you try this

you can use streamstats
or

 |stats values(InitalTag) by ID 

View solution in original post

0 Karma

hi @patricianaguit

Can you try this

you can use streamstats
or

 |stats values(InitalTag) by ID 

View solution in original post

0 Karma

Explorer

thank you!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!