Splunk Search

how to make a complex query on logs

holmla
New Member

The data I have can be condensed to rows of:
user: device: version:

( notation: 2x v1 = user with 2 devices, each with version: v1 )
A user can have any amount of devices, each having some version. What i would like to get is a count of how many users there are with each existing spread of versions, so that a user with 1x v1 is in a different category than a user with 1x v1 and 1x v2, A user can also have 2 devices with v1, and i would like those users separated as well.

for instance:
20 users with 1x v1
25 users with 1x v2
5 users with 2x v1
...
37 users with 2x v2 and 1x v3
39 users with 3x v2 and 1x v3
... and so on

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

'... | stats count(user) by version | ...'

---
If this reply helps you, Karma would be appreciated.
0 Karma

holmla
New Member

That gives me:
v1: n
v2: m
...
It doesn't tell me anything about how many users with combination of v1 AND v2 for instance

0 Karma

holmla
New Member

The captcha on editing a post seems to be broken, gave up after 40 or so attempts. Anyway,
The data I have can be condensed to rows of:
user:"This is used to differentiate users" device: "this is unique per device" version: this has four possible values: v1,v2,v3,v4"

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...