Logscape Support

Members Login
Username 
 
Password 
    Remember Me  
Logscape Support -> logscape -> How to do Splunk dedup with Logscape?
Post Info TOPIC: How to do Splunk dedup with Logscape?
timidri


Newbie

Status: Offline
Posts: 2
Date:
How to do Splunk dedup with Logscape?
Permalink  
 

We are translating some Splunk queries to Logscape. We have 

dedup USER,CorrID | count by USER

 

 

Which, given

USER     CorrID

U1      C1

U1      C1

U1      C2

U2      C1

U2      C1

 

Produces the result:

U1      2

U2      1

 

How can we reach this result with Logscape? I am aware of

countSingle/countMembers([groupByField],)

Counts up to 1 hit per bucket. Use this analytic when you are interested in thenumber of different instances  

but not sure whether I can use that and how exactly.

 

 

Thanks in advance!

 



__________________
ZG


Veteran Member

Status: Offline
Posts: 60
Date:
Permalink  
 

Hi timidri,

You can use the countUnique function. Update your search to look something like this:

ID.countUnique(user,)

This will count all the unique ids for each user. You have a few options on how you may want to represent the data.

You could use a simple time series view or

| ID.countUnique(user,) chart(stacked )


a tabular view to view the results. 

| ID.countUnique(user,) chart(table) buckets(1)



ZG logo










__________________
Anonymous

Date:
Permalink  
 

Hi Z,

Thanks for your reply. I have tried and I think the table results are promising. However, the stacked chart is useless I think - the chart does not change over time. Is that correct?

Also, examples for countUnique() at http://logscape.github.io/searching-functions.html don't really mention countUnique itself, maybe needing an update?

Thanks,

Dimitri

 

 

 



__________________
timidri


Newbie

Status: Offline
Posts: 2
Date:
Permalink  
 

Hi Z,
A correction to my own post (forgot to login so the post became anonymous):
- the stacked chart does work BUT
- ID.countUnique(user,) should be ID.countUnique(user). If you put a comma behind user, the chart becomes like so: http://screencast.com/t/0eYLScKQ5gDl . Any ideas why?
Anonymous wrote:

Thanks for your reply. I have tried and I think the table results are promising. However, the stacked chart is useless I think - the chart does not change over time. Is that correct?

Also, examples for countUnique() at http://logscape.github.io/searching-functions.html don't really mention countUnique itself, maybe needing an update?

Thanks,

Dimitri

 

 

 

 



__________________
Page 1 of 1  sorted by
 
Quick Reply

Please log in to post quick replies.
Logscape Support -> logscape -> How to do Splunk dedup with Logscape?


Create your own FREE Forum
Report Abuse 		Powered by ActiveBoard