Splunk Search

Query to find events with more than 2 values for a specific field compared to another field

john_byun
Path Finder

I'm trying to create a query to show me all users who have purchased more than 1 type of product.

Each event has a "user" field and a "product" field.  I only want to see the users that have purchased more than 1 type of product.

"| stats count by user product" 

This shows me all user and product combinations, but don't know how to filter all events where a user only purchased one type of product.

I feel that it should be a very simple query, but can't seem to figure it out.

Labels (5)
Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @john_byun,

Please try below;

| stats dc(product) as count by user
| where count>1

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @john_byun,

Please try below;

| stats dc(product) as count by user
| where count>1

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

john_byun
Path Finder

Perfect!  Thanks for your help.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...