Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About oneemailall
oneemailall
Engager
Member since:
10-20-2023
10-22-2023
Community Statistics
| Posts | 4 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 10-20-2023 |
Activity Feed
- Posted Re: How to group by by email and badge type , then locate the highest level badge & expiry date? on Splunk Search. 10-22-2023 10:27 AM
- Posted Re: How to group by by email and badge type , then locate the highest level badge & expiry date? on Splunk Search. 10-21-2023 12:55 PM
- Posted Re: How to group by by email and badge type , then locate the highest level badge & expiry date? on Splunk Search. 10-21-2023 12:50 PM
- Posted How to group by by email and badge type , then locate the highest level badge & expiry date? on Splunk Search. 10-20-2023 06:47 PM
- Tagged How to group by by email and badge type , then locate the highest level badge & expiry date? on Splunk Search. 10-20-2023 06:47 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
10-22-2023
10:27 AM
Hi inventsekar, Thank you for explaining the parts of your search. The suggestions you gave helped to create a report that gives a list of unique badges (up to 3 entries for Sell and up to 3 entries for Deploy) per user, showing the badge with the latest expiration date. The challenge now is to filter the results so that each person only shows the highest level badge earned (per badge type). So, each person will have a maximum of two entries in the final report if they have earned a Sell type badge and a Deploy type badge. To answer your previous question, users who pass the renewal badge will have the badge "Renew_" prefix in the badge field. Your suggestion to remove the prefix worked. Thank you for the suggestion. When a renew badge is earned, it will extend the original badge expiration date further out in time. Using the demo data I provided, the final report should look like below. Domain First name Last name Email Badge ExpireDate mno.com lisa edwards lisa.edwards@mno.com Sell_Expert 12/6/23 mno.com lisa edwards lisa.edwards@mno.com Deploy_Capable 8/1/24 abc.com allen anderson allen.anderson@abc.com Sell_Novice 10/3/24 def.com andy braden andy.braden@def.com Deploy_Capable 1/3/24 ghi.com bill connors bill.connors@ghi.com Sell_Novice 10/17/23 jkl.com brandy duggan brandy.duggan@jkl.com Sell_Expert 9/5/24 Assuming that the data set has already been filtered to produce a list of badges with the latest expiration date, what type of search can look at the badge type (per person), and filter to the highest level badge (per badge type) and return only that data? For example, let's take "Person A". For the Sell type badge, the highest level is Sell_Expert. If "Person A" has earned "Sell_Expert", then only "Sell_Expert" (with the latest expiration date), will show up in the report for the Sell type badge. If "Person A" has not earned Sell_Expert yet, then the highest level for "Person A" is Sell_Capable. If "Person A" has not earned Sell_Capable yet, then the highest level for "Person A" is Sell_Novice. If "Person A" has not earned any Sell type badge yet, they will not have a Sell badge type listed in the final report. It will be the same logic for Deploy type badge. Thank you.
... View more
10-21-2023
12:55 PM
Hi yuanliu, Thank you for answering my query. I am still trying to figure out why your solution works. 😀 I was able to modify it as you suggested to get the report I needed. I hope I correctly gave you credit for the solution. I hope you not only get karma points in this community but also good karma points in life. Cheers.
... View more
10-21-2023
12:50 PM
Hi inventsekar, I sincerely appreciate your spending time to solve my issue. I tested your suggestion, but still ended up with duplicate entries for people with the same type of badge (Sell or Deploy). For example, Brandy Duggan should have only one entry, the highest level of Badge type "Sell" which is Brandy Duggan, Sell_Expert, 9/5/24. The results should look similar to this. Domain, First name, Last name, Email, Badge, ExpireDate mno.com, lisa edwards, lisa.edwards@mno.com, Sell_Expert, 12/6/23 (only show highest level badge of type "Sell") mno.com, lisa edwards, lisa.edwards@mno.com, Deploy_Capable, 8/1/24 (only show highest level badge of type "Deploy") abc.com, allen anderson, allen.anderson@abc.com, Sell_Novice, 10/3/24 (allen anderson renewed his badge and expiry date is updated to reflect that) def.com, andy braden, andy.braden@def.com, Deploy_Capable, 1/3/24 ghi.com, bill connors, bill.connors@ghi.com, Sell_Novice, 10/17/23 jkl.com, brandy duggan, brandy.duggan@jkl.com, Sell_Expert, 9/5/24 Thank you again for helping me. Cheers.
... View more
10-20-2023
06:47 PM
Cheers, I am hoping to get some help on a splunk search to generate a badging report. I'll explain further. There are two types of badges students can earn, Sell & Deploy. There are three levels of badges within each badge type. The levels are Novice, Capable and Expert. Issued badges expire after one year. This means students must either renew their existing badge before the expiration date or the student can earn the next level higher badge prior to the expiration date. If a student renews their existing badge, the internal system marks the badge name as Renew_Novice, Renew_Capable, or Renew_Expert depending on which badge they earn. I've supplied some demo data to help illustrate what the data looks like. I need to generate a report that lists the student's name, email address, highest level badge name and expiration date of the highest level badge. There is no need to see lower level badges or expiration dates for lower level badges. Thank you. Each event is a student name and badge type. I onboarded the data so that the timestamp for each event ( _time) is the EarnDate of the badge The output of the Splunk report should show the following: Domain, First name, Last name, Email, Badge, ExpireDate mno.com, lisa edwards, lisa.edwards@mno.com, Sell_Expert, 12/6/23 mno.com, lisa edwards, lisa.edwards@mno.com, Deploy_Capable, 8/1/24 abc.com, allen anderson, allen.anderson@abc.com, Sell_Novice, 10/3/24 def.com, andy braden, andy.braden@def.com, Deploy_Capable, 1/3/24 ghi.com, bill connors, bill.connors@ghi.com, Sell_Novice, 10/17/23 jkl.com, brandy duggan, brandy.duggan@jkl.com, Sell_Expert, 9/5/24 Demo Data below. First name Last name Email Domain Badge EarnDate ExpireDate lisa edwards lisa.edwards@mno.com mno.com Sell_Novice 5/22/22 5/22/23 lisa edwards lisa.edwards@mno.com mno.com Deploy_Novice 5/27/22 5/27/23 andy braden andy.braden@def.com def.com Deploy_Novice 11/10/22 11/10/23 allen anderson allen.anderson@abc.com abc.com Sell_Novice 11/18/22 11/18/23 andy braden andy.braden@def.com def.com Deploy_Capable 1/3/23 1/3/24 bill connors bill.connors@ghi.com ghi.com Sell_Novice 10/17/22 10/17/23 brandy duggan brandy.duggan@jkl.com jkl.com Sell_Novice 7/6/23 7/6/24 lisa edwards lisa.edwards@mno.com mno.com Sell_Capable 7/24/22 7/24/23 lisa edwards lisa.edwards@mno.com mno.com Deploy_Capable 8/20/22 8/20/23 brandy duggan brandy.duggan@jkl.com jkl.com Sell_Capable 8/10/23 8/10/24 brandy duggan brandy.duggan@jkl.com jkl.com Sell_Expert 9/5/22 9/5/24 allen anderson allen.anderson@abc.com abc.com Renew_Sell_Novice 10/3/23 10/3/24 lisa edwards lisa.edwards@mno.com mno.com Sell_Expert 12/6/22 12/6/23 lisa edwards lisa.edwards@mno.com mno.com Renew_Deploy_Capable 8/1/23 8/1/24
... View more
- Tags:
- stats
Labels
- Labels:
-
stats
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-22-2023
03:14 PM
|
