<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to sum the count of three users? in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-count-of-three-users/m-p/328033#M165491</link>
    <description>&lt;P&gt;Hi&lt;BR /&gt;
Can you please accept this question to mark as close?&lt;/P&gt;</description>
    <pubDate>Fri, 27 Oct 2017 13:18:54 GMT</pubDate>
    <dc:creator>kamlesh_vaghela</dc:creator>
    <dc:date>2017-10-27T13:18:54Z</dc:date>
    <item>
      <title>How to sum the count of three users?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-count-of-three-users/m-p/328030#M165488</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;in my scenario i have a lot of users for example: user1, user2, user3... and i want to count their logins to a server and create a pie chart. I have the problem that there are some users which have the same name but a different notation for example user1, USER1 and USer1. How can i sum the counts of these 3, allocate it to user1 and create the pie chart?&lt;/P&gt;

&lt;P&gt;Thx for your help!&lt;/P&gt;</description>
      <pubDate>Fri, 27 Oct 2017 09:04:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-count-of-three-users/m-p/328030#M165488</guid>
      <dc:creator>reschal</dc:creator>
      <dc:date>2017-10-27T09:04:00Z</dc:date>
    </item>
    <item>
      <title>Re: How to sum the count of three users?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-count-of-three-users/m-p/328031#M165489</link>
      <description>&lt;P&gt;Hi  reschal,&lt;/P&gt;

&lt;P&gt;you can lower the user names.&lt;/P&gt;

&lt;P&gt;Can you please try this?&lt;/P&gt;

&lt;P&gt;YOUR_SEARCH | eval user_field =lower(user_field) | stats count by user_field&lt;/P&gt;

&lt;P&gt;just add extra eval before stats command.&lt;/P&gt;

&lt;P&gt;thanks&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 16:30:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-count-of-three-users/m-p/328031#M165489</guid>
      <dc:creator>kamlesh_vaghela</dc:creator>
      <dc:date>2020-09-29T16:30:18Z</dc:date>
    </item>
    <item>
      <title>Re: How to sum the count of three users?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-count-of-three-users/m-p/328032#M165490</link>
      <description>&lt;P&gt;Thanks, it works &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 27 Oct 2017 13:07:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-count-of-three-users/m-p/328032#M165490</guid>
      <dc:creator>reschal</dc:creator>
      <dc:date>2017-10-27T13:07:28Z</dc:date>
    </item>
    <item>
      <title>Re: How to sum the count of three users?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-count-of-three-users/m-p/328033#M165491</link>
      <description>&lt;P&gt;Hi&lt;BR /&gt;
Can you please accept this question to mark as close?&lt;/P&gt;</description>
      <pubDate>Fri, 27 Oct 2017 13:18:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-count-of-three-users/m-p/328033#M165491</guid>
      <dc:creator>kamlesh_vaghela</dc:creator>
      <dc:date>2017-10-27T13:18:54Z</dc:date>
    </item>
  </channel>
</rss>

