Morning, Splunkers! I've got a fun one today. I need to find the most resource efficient way (i.e., fastest way that won't have my IT guys calling me up and wanting to know why their ports are smoki...
See more...
Morning, Splunkers! I've got a fun one today. I need to find the most resource efficient way (i.e., fastest way that won't have my IT guys calling me up and wanting to know why their ports are smoking) to return the unique values in one field that only have unique values in another field. For example, in the following table my search result needs to only return Value B; Values A and C will be thrown out, because they don't have a unique value in Field B. Field A Field B Value A Value A1 Value A Value A2 Value B Value B1 Value C Value C1 Value C Value C2 Value C Value C3 The big problem here is Field B can be any number of different values, so I can't query specifically on what those values may be. I have a solution for this, and it works, but it doesn't work "at scale" because I'm looking through literally billions of records to pull this information. Here's what I'm already doing: | tstats count where index=myindex by Field A Field B
| stats values(Field B) as Field B by Field A
| where mvcount(Field B)=1 This takes a few minutes if I'm pulling, say, over 15 minutes, and I need to pull 90 days, and I really don't want to have to do it 15 minutes at a time and stitch everything together afterward. I will if I have to, but there's got to be a better way to do what I'm trying to do that won't make the system flip me the bird and call it a day. Suggestions?