Splunk Search

grouping similar field values

atreece
Path Finder

I have a set of events that are generated with locations in the form of xloc and yloc. (z, or height, is irrelevant) I am trying to find events that happen in the same place, but I want to group any events that happen in the same area, say 5 meters. (+-5)
Is there a way to do this in splunk?

Tags (1)
0 Karma
1 Solution

Ayn
Legend

You could probably use bucket for this. bucket puts continuous numerical values into discrete sets, so you could group together all xloc/yloc points within the same general area. Using this, if you'd want to get a count of the events within a certain range, you could do something like:

... | bucket xloc span=10 | bucket yloc span=10 | stats count by xloc,yloc

More information on the bucket command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Bucket

View solution in original post

Ayn
Legend

You could probably use bucket for this. bucket puts continuous numerical values into discrete sets, so you could group together all xloc/yloc points within the same general area. Using this, if you'd want to get a count of the events within a certain range, you could do something like:

... | bucket xloc span=10 | bucket yloc span=10 | stats count by xloc,yloc

More information on the bucket command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Bucket

Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...