Splunk Search

Is it possible to find the most common value of a field per user?

HeinzWaescher
Motivator

Hi,

Is it possible to find out the most common value of field=A for every user?

I would expect something like this, but i don't know a corresponding stats function:

... | stats function(country_code) BY user_id

BR

Heinz

Tags (1)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Here, you would most likely want to use top:

... | top limit=1 country_code by user_id

This will give you the top country_code, limit of 1 per user.

View solution in original post

p3hndrx
Explorer

I think you are looking for mode(x):

 <your search> | stats mode(country_code) by user_id
0 Karma

malvidin
Communicator

 

I agree that mode function is most likely what @HeinzWaescher  was looking for. 

Because it is a stats function, you can also use it with eventstats to keep the events. 

| eventstats mode(country_code) by user_id

For the example initially provided, the top command does not appear any better than the stats mode() command provided by @p3hndrx. But if you the top N values (N>=2), there is no function like values() that returns them sorted by frequency of occurrence. 

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Here, you would most likely want to use top:

... | top limit=1 country_code by user_id

This will give you the top country_code, limit of 1 per user.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...