Splunk Search

dedup on Field over time span

triva79
Explorer

we have data in Splunk for user sessions in an app and I am trying to produce a line graph to show usage every hour. the session information is added 4 times an hour so trying to remove the extra results per hour

below is an example for one user but there will be other user data as well 

userName: fred
sessionKey: a0b360d9-a471-45a1-9dcc-0dee39ed6ba8
timestamp: 2024-05-20T12:00:00Z

userName: fred
sessionKey: a0b360d9-a471-45a1-9dcc-0dee39ed6ba8
timestamp: 2024-05-20T12:30:00Z

userName: fred
sessionKey: a0b360d9-a471-45a1-9dcc-0dee39ed6ba8
timestamp: 2024-05-20T12:45:00Z

userName: fred
sessionKey: a0b360d9-a471-45a1-9dcc-0dee39ed6ba8
timestamp: 2024-05-20T13:00:00Z

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The session is only present 3 times in the hour, the fourth one at 13:00 is in the next hour

Anyway, assuming you still want to count different sessions for the same user separately, you can do the stats twice

| bin _time span=1h
| stats count by _time, userName, sessionKey
| stats count by _time, userName

Depending on what count you actually want, you could also do this

| bin _time span=1h
| stats count by _time, userName, sessionKey
| stats count by _time

View solution in original post

0 Karma

bandit
Motivator

@triva79 

How about...

| timechart span=1h limit=50 useother=false dc(userName) as count by userName


or maybe...

| eval session=userName+":"+sessionKey
| timechart span=1h limit=50 useother=false dc(session) as count by session
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The session is only present 3 times in the hour, the fourth one at 13:00 is in the next hour

Anyway, assuming you still want to count different sessions for the same user separately, you can do the stats twice

| bin _time span=1h
| stats count by _time, userName, sessionKey
| stats count by _time, userName

Depending on what count you actually want, you could also do this

| bin _time span=1h
| stats count by _time, userName, sessionKey
| stats count by _time
0 Karma

triva79
Explorer

thanks so much 🙂 only my 2nd day using Splunk

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @triva79 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @triva79,

you could use timechart or dedup:

<your_search>
| timechart span=1h count BY userName

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...