Splunk Search

separately calculated stats side by side in a table

Engager

I am building a table displayed in a splunk dashboard that needs a complicated query and I was hoping to get a quick pointer in the right direction.

Let's say I have a table of events at different levels per person.

 id event_id level_id user_id 1 1 1 1 2 1 2 1 3 1 1 2 4 1 2 2 5 1 3 2 6 1 1 3

For these events, only the highest level event is relevant per person. How would I construct a query that shows the following stats, side by side:

1) the total number for each event at each level (3rd column below, I have this part) and

2) the number of users at a specific event level (4th column below) this is basically the count of the highest level per event per person

The results I'm looking for would look like:

 event_id level_id total_occured total_users_at_level 1 1 3 1 1 2 2 1 1 3 1 1

Any help would be greatly appreciated. Thanks!

Labels (1)
• stats

1 Solution
SplunkTrust

Give this a try

your current query that returns fields:  id event_id level_id user_id
| eventstats count as total_occured by level_id
| stats last(event_id) as event_id last(level_id) as level_id last(total_occured) as total_occured by user_id
| stats values(total_occured) as total_occured dc(user_id) as total_users_at_level by event_id level_id
SplunkTrust

Give this a try

your current query that returns fields:  id event_id level_id user_id
| eventstats count as total_occured by level_id
| stats last(event_id) as event_id last(level_id) as level_id last(total_occured) as total_occured by user_id
| stats values(total_occured) as total_occured dc(user_id) as total_users_at_level by event_id level_id
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...