Hi,
If I have several events like this:
ID1 name1
ID2 name2
ID3 name1
ID3 name1
ID3 name1
ID4 name3
ID3 name1
I would like to have the number of successive events by ID and by Name. So it will give me something like this:
ID1 name1 1
ID2 name2 1
ID3 name1 3
ID4 name3 1
ID3 name1 1
My problem is with the transaction. It will regroup every identical ID instead of regrouping events that are successive, with the same ID and name.
Can someone help me?
Thanks
If those have field names of "ID" and "Name", then the simple way would be
... | stats count by ID, Name
Transaction could be useful in other circumstances (perhaps even on this same data), but isn't probably what you need here.
I believe you are looking for the eventstats command http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/eventstats
In your example, something like this may work..`.. | sort idcolname | eventstats count by idcolname | dedup idcolname
If this doesn't give you what you are looking for, try the streamstats command` http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/streamstats
If those have field names of "ID" and "Name", then the simple way would be
... | stats count by ID, Name
Transaction could be useful in other circumstances (perhaps even on this same data), but isn't probably what you need here.
thanks for answering. The problem is with your order the result will be
ID1 name1 1
ID2 name2 1
ID3 name1 4
ID4 name3 1
And I want something like
ID1 name1 1
ID2 name2 1
ID3 name1 3
ID4 name3 1
ID3 name1 1
as you can see it's different from what I want, i want to count ONLY the following events who own the same ID/NAME!
could you help ?
So you need them bounded by intervening, non-matching events? What I mean by that is that you want to not have a transaction cross another item - so an ID4 splits that ID3/name1 into two chunks, the before one and after one. Right?
If so, I'd recommend using streamstats to split your events by counting number of distinct IDs in a two-item streamstats group. The short version:
... | streamstats window=2 distinct_count(ID) AS splitter| transaction startswith=splitter>1 ID name
The longer version: I answered another question a while back with a similar solution that has explanations, so please refer to this answer here for more information.
Let me know how it goes or if you need help with some tweaking!
anyone can help 🙂 ?