Splunk Search

How find how many inquiry is assigned to particular person?

pal_sumit1
Path Finder

Suppose we are inquiry id as 1,2,3,4,5,6,7,8,9,10 and these are assigned to some person p1,p2,p3,p4.
Then 1,2,3,5 inquiry is assigned to p1 , 4,6 assigned to p2,7,8,9, assigned to p3 and 10 assigned to p4.

So the question is how to display person's having more than 1 inquiry assigned to them.
And we do not know about person name and inquiry,It is just present in database.

Tags (1)
0 Karma

niketn
Legend

@pal_sumit1, without details like sample data and field names and your existing query etc. it is difficult to assist you. However, based on your question seems like you are asking for something like the following. PS: dc() aggregate function gives distinct count.

<yourbasesearch> person=* inquiry=*
| stats dc(inquiry) as inquiryCount by person
| search inquiryCount >1
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

pal_sumit1
Path Finder

Yes,you are right,I am also doing like this.But is there is another way to do this?

0 Karma

niketn
Legend

Could you please let us know the reason to look for another way to do this? Is there performance issue or different use case?

To me it seems correct way to identify persons you are interested in. You can also use values() to show unique values of inquiries

 <yourbasesearch> person=* inquiry=*
 | stats dc(inquiry) as inquiryCount values(inquiry) as inquiries by person
 | search inquiryCount >1
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@pal_sumit1 if this addresses your need, please accept the answer to mark this question as answered. If not please let us know any further queries that you may have!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...