Splunk Search

Searching back in time to determine newness (or not) of a value in a given field

JohnR
Engager

Given a field containing a "userId", I want a count per day of unique userIds by "new" vs "returning". E.g. Ends up with this output...

| timechart span=1d dc(userId) by newOrReturning

or I suppose...

| bin _time span=1d
| stats dc(userId) by _time, newOrReturning

A userId is "new" on a given day if there is no record of it from any previous day, going as far back as a known fixed date.

The bit I'm having trouble with is how to set newOrReturning, since (I assume) I need to somehow search back in time for a matching userId from previous days.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this (set time period to be all time or since whatever date you want to consider)

| bin _time span=1d
| eventstats earliest(_time) as firsttime by userid
| eval newOrReturning=if(_time=firsttime,"New","Returning")
| stats dc(userId) by _time, newOrReturning

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this (set time period to be all time or since whatever date you want to consider)

| bin _time span=1d
| eventstats earliest(_time) as firsttime by userid
| eval newOrReturning=if(_time=firsttime,"New","Returning")
| stats dc(userId) by _time, newOrReturning
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...