Splunk Search

distinct_count (dc) threshold

yannquique
New Member

I'm trying to eliminate results below a threshold with dc and it's not working. I only want to show versions that have at least 10 users. Here's some of what I've tried:

  1. Syntax error
    index = data | timechart span=1w dc(userid) as Users by version where Users > 10

  2. Only get 1 result back for a version "OTHER"
    index = data | timechart span=1w dc(userid) as Users by version where dc > 10

  3. No results
    index = data | timechart span=1w dc(userid) as Users by version | where Users > 10
    index = data | timechart span=1w dc(userid) as Users by version | where version > 10

  4. Nothing is filtered (count and dc are clearly different values)
    index = data | timechart span=1w dc(userid) as Users by version where Users > 10 where count > 10

Thanks

0 Karma
1 Solution

njohnson7
Path Finder

@yannquique

I believe When you do a timechart, all you see there is your values split by versions for different time buckets and there is no field named Users for Splunk to apply that mathematical condition you specify in the where clause and hence it is returning no results.

Could you try this and see?

index = data 
| bucket span=1w _time  
| stats dc(userid) as Users by _time version 
| where Users > 10 
| xyseries _time, version, Users 
| fillnull value=0

View solution in original post

0 Karma

njohnson7
Path Finder

@yannquique

I believe When you do a timechart, all you see there is your values split by versions for different time buckets and there is no field named Users for Splunk to apply that mathematical condition you specify in the where clause and hence it is returning no results.

Could you try this and see?

index = data 
| bucket span=1w _time  
| stats dc(userid) as Users by _time version 
| where Users > 10 
| xyseries _time, version, Users 
| fillnull value=0
0 Karma

yannquique
New Member

That works great! Thank you.
I'm very impressed with your splunk query knowledge. I'm going to have to play around with all those commands to try and understand how it works. It's not simple and you got it first time.

Thanks again

0 Karma

richgalloway
SplunkTrust
SplunkTrust

index = data | timechart span=1w dc(userid) as Users by version | where Users > 10 should work. Are you sure you have a field called 'userid' in the 'data' index?
What do you get from index = data | timechart span=1w dc(userid) as Users by version?

---
If this reply helps you, Karma would be appreciated.
0 Karma

yannquique
New Member

Thanks for the reply! Without the where clause, I get all the data I expect plus the values that don't interest me:
_time:2020-03-03
v3.1:210
v3.2:1719
v3.3.0:7

When I add the where clause I get "No results found"

0 Karma

yannquique
New Member

If it's important: I'm using Splunk Enterprise v7.3.3

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...