Splunk Search

Timechart & Stats Dc.

IRHM73
Motivator

Hi, I wondered whether someone may be able to help me please.

I'm using the query below which works but contains duplicate id numbers under field "detail.ur"

 index=main auditSource=preferences-frontend auditType=TxSucceeded tags.transactionName="Show Print Preference Option"
|eval Interstitpage=if('detail.journey'="Interstitial",1, 0 ) 
|eval AccountPage=if('detail.journey'="AccountDetails",1, 0 ) 
|timechart  span=1d sum(Interstitpage) AS ShownInterstitial, sum(AccountPage) AS ShownAccountPage 
|reverse

I'm trying to incorporate the "stats dc" command to remove these duplicates rather than the dedup because there are a lot of records involved and I know the dedup can be a little inefficient.

I've tried incorporating the "stats dc" in multiple areas of the query but I just can't get this to work.

I just wondered whether someone may be able to point me in the right direction so I may be able to get this to work.

Many thanks and kind regards

Chris

0 Karma
1 Solution

woodcock
Esteemed Legend

Your search does not contain any reference to field detail.ur so it cannot exist in your results and there is no way to examine it. If you know that your data has duplicate events then the proper thing to do is reduce them before you pas to timestats/chart/stats. The most straightforward (and perfectly correct/efficient) way to do this is by using dedup detail.ur as soon as possible before timechart.

View solution in original post

woodcock
Esteemed Legend

Your search does not contain any reference to field detail.ur so it cannot exist in your results and there is no way to examine it. If you know that your data has duplicate events then the proper thing to do is reduce them before you pas to timestats/chart/stats. The most straightforward (and perfectly correct/efficient) way to do this is by using dedup detail.ur as soon as possible before timechart.

fdi01
Motivator

try :

  index=main auditSource=preferences-frontend auditType=TxSucceeded tags.transactionName="Show Print Preference Option"
     |eval Interstitpage=if('detail.journey'="Interstitial",1, 0 ) 
     |eval AccountPage=if('detail.journey'="AccountDetails",1, 0 ) 
     |timechart  span=1d sum(Interstitpage) AS ShownInterstitial, sum(AccountPage) AS ShownAccountPage by "detail.ur"
     |reverse

or

...|rename "detail.ur" as ID |timechart  span=1d sum(Interstitpage) AS ShownInterstitial, sum(AccountPage) AS ShownAccountPage by ID| reverse
0 Karma

IRHM73
Motivator

Hi, thank you for coming back to me with this.

I have tried the first query you kindly provided, but unfortunately this doesn't work because it actually creates a column for each "detail.ur" value, rather than summing these under "ShownInterstitial" and "ShowAccountPage" and unfortunately your second query doesn't return any results.

Many thanks and kind regards

Chris

0 Karma
Get Updates on the Splunk Community!

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...