Splunk Search

distinct_count (dc) threshold

yannquique
New Member

I'm trying to eliminate results below a threshold with dc and it's not working. I only want to show versions that have at least 10 users. Here's some of what I've tried:

  1. Syntax error
    index = data | timechart span=1w dc(userid) as Users by version where Users > 10

  2. Only get 1 result back for a version "OTHER"
    index = data | timechart span=1w dc(userid) as Users by version where dc > 10

  3. No results
    index = data | timechart span=1w dc(userid) as Users by version | where Users > 10
    index = data | timechart span=1w dc(userid) as Users by version | where version > 10

  4. Nothing is filtered (count and dc are clearly different values)
    index = data | timechart span=1w dc(userid) as Users by version where Users > 10 where count > 10

Thanks

0 Karma
1 Solution

njohnson7
Path Finder

@yannquique

I believe When you do a timechart, all you see there is your values split by versions for different time buckets and there is no field named Users for Splunk to apply that mathematical condition you specify in the where clause and hence it is returning no results.

Could you try this and see?

index = data 
| bucket span=1w _time  
| stats dc(userid) as Users by _time version 
| where Users > 10 
| xyseries _time, version, Users 
| fillnull value=0

View solution in original post

0 Karma

njohnson7
Path Finder

@yannquique

I believe When you do a timechart, all you see there is your values split by versions for different time buckets and there is no field named Users for Splunk to apply that mathematical condition you specify in the where clause and hence it is returning no results.

Could you try this and see?

index = data 
| bucket span=1w _time  
| stats dc(userid) as Users by _time version 
| where Users > 10 
| xyseries _time, version, Users 
| fillnull value=0
0 Karma

yannquique
New Member

That works great! Thank you.
I'm very impressed with your splunk query knowledge. I'm going to have to play around with all those commands to try and understand how it works. It's not simple and you got it first time.

Thanks again

0 Karma

richgalloway
SplunkTrust
SplunkTrust

index = data | timechart span=1w dc(userid) as Users by version | where Users > 10 should work. Are you sure you have a field called 'userid' in the 'data' index?
What do you get from index = data | timechart span=1w dc(userid) as Users by version?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

yannquique
New Member

Thanks for the reply! Without the where clause, I get all the data I expect plus the values that don't interest me:
_time:2020-03-03
v3.1:210
v3.2:1719
v3.3.0:7

When I add the where clause I get "No results found"

0 Karma

yannquique
New Member

If it's important: I'm using Splunk Enterprise v7.3.3

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>