Splunk Search

how to make a complex query on logs

holmla
New Member

The data I have can be condensed to rows of:
user: device: version:

( notation: 2x v1 = user with 2 devices, each with version: v1 )
A user can have any amount of devices, each having some version. What i would like to get is a count of how many users there are with each existing spread of versions, so that a user with 1x v1 is in a different category than a user with 1x v1 and 1x v2, A user can also have 2 devices with v1, and i would like those users separated as well.

for instance:
20 users with 1x v1
25 users with 1x v2
5 users with 2x v1
...
37 users with 2x v2 and 1x v3
39 users with 3x v2 and 1x v3
... and so on

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

'... | stats count(user) by version | ...'

---
If this reply helps you, Karma would be appreciated.
0 Karma

holmla
New Member

That gives me:
v1: n
v2: m
...
It doesn't tell me anything about how many users with combination of v1 AND v2 for instance

0 Karma

holmla
New Member

The captcha on editing a post seems to be broken, gave up after 40 or so attempts. Anyway,
The data I have can be condensed to rows of:
user:"This is used to differentiate users" device: "this is unique per device" version: this has four possible values: v1,v2,v3,v4"

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...