https://community.splunk.com/t5/Security/How-to-list-page-by-user/m-p/475056#M11018 <P>If you want the values of pages as a comma separated list use this.</P> <PRE><CODE>|stats values(page) by user delim="," </CODE></PRE> <P>If you just want a multivalue field, remove <CODE>delim=","</CODE> from the above list.</P> <P>Hope this helps.</P> <P>Cheers</P> Mon, 04 Nov 2019 13:27:31 GMT arjunpkishore5 2019-11-04T13:27:31Z https://community.splunk.com/t5/Security/How-to-list-page-by-user/m-p/475054#M11016 <P>I am a bit rusty on my Splunk search basics.</P> <P>I have a userstats log. I need to list the values (contentId) for each userId in an exportable table. Basically, I want a list of all pages a user has visited. I want the list displayed by user. I only want the page listed once per user. If two users visit the same page the page needs to be listed for each user. If one user visits the same page twice, it needs to be listed only once for that user.</P> <P>OUTPUT</P> <PRE><CODE>user1 | pagexyz,pagewrx,pagetuv user2 | pageabc,pagedef,pageghi user3 | .... user4... </CODE></PRE> <P>The trouble I have is I want each to page item per user listed only once alphabetically. I don't want to dedup incorrectly and take a page user1 viewed from user2. I am specifying a large list of users hardcoded using a search macro. </P> <P>What is the correct command? </P> Mon, 04 Nov 2019 13:14:39 GMT https://community.splunk.com/t5/Security/How-to-list-page-by-user/m-p/475054#M11016 user93 2019-11-04T13:14:39Z https://community.splunk.com/t5/Security/How-to-list-page-by-user/m-p/475055#M11017 <P>try this:<BR /> <CODE>your search .... | stats values(page_field) as pages by user_field ...</CODE></P> Mon, 04 Nov 2019 13:27:23 GMT https://community.splunk.com/t5/Security/How-to-list-page-by-user/m-p/475055#M11017 adonio 2019-11-04T13:27:23Z https://community.splunk.com/t5/Security/How-to-list-page-by-user/m-p/475056#M11018 <P>If you want the values of pages as a comma separated list use this.</P> <PRE><CODE>|stats values(page) by user delim="," </CODE></PRE> <P>If you just want a multivalue field, remove <CODE>delim=","</CODE> from the above list.</P> <P>Hope this helps.</P> <P>Cheers</P> Mon, 04 Nov 2019 13:27:31 GMT https://community.splunk.com/t5/Security/How-to-list-page-by-user/m-p/475056#M11018 arjunpkishore5 2019-11-04T13:27:31Z https://community.splunk.com/t5/Security/How-to-list-page-by-user/m-p/475057#M11019 <P>thank you. I was trying the list command and forgot about the values command. </P> Mon, 04 Nov 2019 13:31:51 GMT https://community.splunk.com/t5/Security/How-to-list-page-by-user/m-p/475057#M11019 user93 2019-11-04T13:31:51Z