Splunk Search

When is Cheryl's Bday?... According to Splunk

Path Finder

Well this is interesting, as you know there is a logic problem posted in many sites about the age of a girl named Cheryl:

The problem goes like this:

Albert and Bernard just met Cheryl.
and said, “I’m not going to tell you, but I’ll give you some clues.”

She wrote down a list of 10 dates:
May 15, May 16, May 19 June 17, June 18 July 14, July 16 August 14, August 15, August 17
“My birthday is one of these,” she said.

Then Cheryl whispered in Albert’s ear the month — and only the month — of her birthday.
To Bernard, she whispered the day, and only the day.
“Can you figure it out now?” she asked Albert.

Albert: I don’t know when your birthday is, but I know Bernard doesn't know, either.
Bernard: I didn't know originally, but now I do.
Albert: Well, now I know, too!
When is Cheryl’s birthday?

Tags (3)
1 Solution
Path Finder

Well I think this is a perfect question for Splunk! you have 2 different sources: Albert and Bernard and you need to figure out a way of correlating the information of these two sources so I decided to give it a try and this is what I got:

1)First I created a CSV file with the dates Cheryl provided as input for them:

Month,Day
5,15
5,16
5,19
6,17
6,18
7,14
7,16
8,14
8,15
8,17

2)The first clue is that Albert (who only knows the Month) Knows that Bernard doesn't know. This means that we need to discard months with a unique day otherwise Bernard would know. This translate to splunk to:

|inputlookup dates.csv|stats count by Day |where count=1 | lookup dates.csv Day OUTPUT Month|fields Month
this will give us the Months we need to discard (May,June)

3)Now we can get a reduced list of the potential valid dates once we remove the dates from May and June:

|inputlookup dates.csv
|search NOT [|inputlookup dates.csv|stats count by Day |where count=1 | lookup dates.csv Day OUTPUT Month|fields Month]

4)From that reduced list Bernard was able to figure out the month because the Day he knew appeared only once in either July or Aug:
So we want this additionally reduced list:

|inputlookup dates.csv
|search NOT [|inputlookup dates.csv|stats count by Day |where count=1 | lookup dates.csv Day OUTPUT Month|fields Month]
|stats values(Month) AS Month,count by Day| where count=1

Now we have reduced the list to three potential dates: 7/16, 8/15 and 8/17

4)If Albert was able to figure out the date because the month he knew only gave him 1 option, so we need to get the month with only one possible date:

|inputlookup dates.csv
|search NOT [|inputlookup dates.csv|stats count by Day |where count=1 | lookup dates.csv Day OUTPUT Month|fields Month]
|stats values(Month) AS Month,count by Day| where count=1
|stats values(Day) as Day,count by Month |where count=1

So Cheryl's Bday is July 16th

is this the best way to correlate the information?

Best Regards

Path Finder

Well I think this is a perfect question for Splunk! you have 2 different sources: Albert and Bernard and you need to figure out a way of correlating the information of these two sources so I decided to give it a try and this is what I got:

1)First I created a CSV file with the dates Cheryl provided as input for them:

Month,Day
5,15
5,16
5,19
6,17
6,18
7,14
7,16
8,14
8,15
8,17

2)The first clue is that Albert (who only knows the Month) Knows that Bernard doesn't know. This means that we need to discard months with a unique day otherwise Bernard would know. This translate to splunk to:

|inputlookup dates.csv|stats count by Day |where count=1 | lookup dates.csv Day OUTPUT Month|fields Month
this will give us the Months we need to discard (May,June)

3)Now we can get a reduced list of the potential valid dates once we remove the dates from May and June:

|inputlookup dates.csv
|search NOT [|inputlookup dates.csv|stats count by Day |where count=1 | lookup dates.csv Day OUTPUT Month|fields Month]

4)From that reduced list Bernard was able to figure out the month because the Day he knew appeared only once in either July or Aug:
So we want this additionally reduced list:

|inputlookup dates.csv
|search NOT [|inputlookup dates.csv|stats count by Day |where count=1 | lookup dates.csv Day OUTPUT Month|fields Month]
|stats values(Month) AS Month,count by Day| where count=1

Now we have reduced the list to three potential dates: 7/16, 8/15 and 8/17

4)If Albert was able to figure out the date because the month he knew only gave him 1 option, so we need to get the month with only one possible date:

|inputlookup dates.csv
|search NOT [|inputlookup dates.csv|stats count by Day |where count=1 | lookup dates.csv Day OUTPUT Month|fields Month]
|stats values(Month) AS Month,count by Day| where count=1
|stats values(Day) as Day,count by Month |where count=1

So Cheryl's Bday is July 16th

is this the best way to correlate the information?

Best Regards

Splunk Employee

@aalanisr26, i recommend you edit the question you post above and move the actual answer portion to an answer below so you can get credit for solving this 🙂

Path Finder

I have removed the answer from the question and I will put it on the answer now

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...