Splunk Search

keys with many values

rotten
Communicator

Suppose my log entries resembled:

   Rick ate a cheeseburger
   Tony ate a grape
   Rick ate a frenchfry
   Tony ate a grape
   Rick ate a cheeseburger
   Sally ate a salad
   ...

So I have two fields of interest "name" and "food".

Now, I'd like to know which user eats the most different kinds of food.

I believe the associate command can be used to tell me which users are most likely to eat which foods. What I'd rather find is almost the opposite. Given a key, how many different (unpredictable) values is it paired with?

Then I could do things like send an alert "RicksDog ate 7 different kinds of food in the past 24 hours - he's going to be sick!".

I can easily do this with a script. I'd like to do it in Splunk, if possible.

Tags (1)
0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

Assuming that you've extracted "name" and "food", you can search:

... | stats dc(food) as food_count values(food) as foods by name | sort - food_count

This will give you a sorted list of users by number of food types.

You can also use "eventstats" to calculate the average number of foods if you're unsatisfied with absolute thresholds (fixed counts or top n).

rotten
Communicator

followup - I gave up and wrote a script.

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

You should make sure that both "name" and "food" are in every event being summarized.

0 Karma

rotten
Communicator

This doesn't work. I've tried a few variations on it with no luck. I always get "No Results Found", even though I can see lots of unique field-pairs in the logs.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...