Splunk Search

stats and join not working in map search

aekruse
New Member

I have a search that counts the amount of times a user runs a program, and then returns the usernames of the users who run it more than threshold 'x_times'. The search requires information from two sourcetypes that have one 'event_id' in common.

 

 

index=blah (sourcetype=example_1 OR sourcetype=example_2) earliest=-1d@d
| stats values(username), values(type), values(program_name), values(hostname) by event_id
| search type=filter_1 program_name=filter_2
| eventstats count as user_count by username
| search user_count >= 5
| table username

 

 

 My goal, is that after I have the usernames I'm interested in, I want to be able to run predictions on each username. I have tried this two ways:

Way 1

 

 

| map search="search index=blah (sourcetype=example_1 OR sourcetype=example_2) earliest=-90d@d
| stats values(username), values(type), values(program_name), values(hostname) by event_id
| search username=$username$ type=filter_1 program_name=filter_2
| timechart span=1d count as distinct_count
| predict disinct_count algorithm=LLP5
| table output1, output2, prediction"

 

 

Way 2

 

 

| map search="search index=blah sourcetype=example_1 earliest=-90d@d
| join event_id max=0 [ search index=blah sourcetype=example_2 earlies=-90d@d | table event_id, program_name]
| search username=$username$ type=filter_1 program_name=filter_2
| timechart span=1d count as distinct_count
| predict disinct_count algorithm=LLP5
| table output1, output2, prediction"

 

 

 Experimentation has shown me that the map search can't seem to process past the STATS or the JOIN. Without the STATS or the JOIN, and then only being able to use one filter, I can get it to work. But with them it fails, and I'm unable to get an accurate prediction.

Is there a solution, or do I need to approach this a different way?

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...