https://community.splunk.com/t5/Splunk-Search/how-group-a-field-values-with-the-maxevents-of-4-without-using/m-p/678320#M231966 <LI-CODE lang="markup">| table Botid | streamstats count as row | eval row=row%4 | streamstats count(eval(row=1)) as count | stats list(Botid) as Botid by count | eval Botid=mvjoin(Botid,",")</LI-CODE> Thu, 22 Feb 2024 10:06:03 GMT ITWhisperer 2024-02-22T10:06:03Z https://community.splunk.com/t5/Splunk-Search/how-group-a-field-values-with-the-maxevents-of-4-without-using/m-p/678318#M231965 <P>Hi everyone,<BR /><BR />i need an alternative for the transaction command, bcoz its taking to much time to load the dashboard,<BR /><BR />this is my actual data<BR /><BR />Botid&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;count</P><P>1528&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1&nbsp;</P><P>1228&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1</P><P>1015&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1</P><P>1558&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1</P><P>12&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1</P><P>1698&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1</P><P>1589.15&nbsp; &nbsp; &nbsp; &nbsp; 1</P><P>1589&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1</P><P>&nbsp;</P><P>am looking for an output like below</P><P>BotId&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;count</P><P>1528,1228,1015,1558&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1</P><P>12,1698,1589.2,1589&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 2</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>thanks in advance</P> Thu, 22 Feb 2024 09:49:31 GMT https://community.splunk.com/t5/Splunk-Search/how-group-a-field-values-with-the-maxevents-of-4-without-using/m-p/678318#M231965 vinod743374 2024-02-22T09:49:31Z https://community.splunk.com/t5/Splunk-Search/how-group-a-field-values-with-the-maxevents-of-4-without-using/m-p/678320#M231966 <LI-CODE lang="markup">| table Botid | streamstats count as row | eval row=row%4 | streamstats count(eval(row=1)) as count | stats list(Botid) as Botid by count | eval Botid=mvjoin(Botid,",")</LI-CODE> Thu, 22 Feb 2024 10:06:03 GMT https://community.splunk.com/t5/Splunk-Search/how-group-a-field-values-with-the-maxevents-of-4-without-using/m-p/678320#M231966 ITWhisperer 2024-02-22T10:06:03Z