https://community.splunk.com/t5/Splunk-Search/How-to-group-results-that-has-5-or-more-distinct-values-in-list/m-p/407515#M171864 <P>Perhaps something like this will work for you.</P> <PRE><CODE>query | stats list(repo_name) as repo_names by user_login | where mvcount(repo_names) &gt; 4 </CODE></PRE> Mon, 15 Apr 2019 02:47:31 GMT richgalloway 2019-04-15T02:47:31Z https://community.splunk.com/t5/Splunk-Search/How-to-group-results-that-has-5-or-more-distinct-values-in-list/m-p/407514#M171863 <P>Hi,</P> <P>I have a search query as below.</P> <P>query | stats list(repo_name) by user_login</P> <P>This returns username with their repository listed grouped by the user_login. </P> <P>For example : </P> <P>Name Repository<BR /> user_login XXX</P> <P>How can i enhance the query to only return searches ONLY if the list of repository has 5 or more values ? </P> Wed, 30 Sep 2020 00:05:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-group-results-that-has-5-or-more-distinct-values-in-list/m-p/407514#M171863 wailoont 2020-09-30T00:05:42Z https://community.splunk.com/t5/Splunk-Search/How-to-group-results-that-has-5-or-more-distinct-values-in-list/m-p/407515#M171864 <P>Perhaps something like this will work for you.</P> <PRE><CODE>query | stats list(repo_name) as repo_names by user_login | where mvcount(repo_names) &gt; 4 </CODE></PRE> Mon, 15 Apr 2019 02:47:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-group-results-that-has-5-or-more-distinct-values-in-list/m-p/407515#M171864 richgalloway 2019-04-15T02:47:31Z https://community.splunk.com/t5/Splunk-Search/How-to-group-results-that-has-5-or-more-distinct-values-in-list/m-p/407516#M171865 <P>Many thanks. it works. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 15 Apr 2019 05:58:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-group-results-that-has-5-or-more-distinct-values-in-list/m-p/407516#M171865 wailoont 2019-04-15T05:58:46Z