topic Grouping data based off a single field in Splunk Search https://community.splunk.com/t5/Splunk-Search/Grouping-data-based-off-a-single-field/m-p/680465#M232576 <P>I have all the relevant data I need from a single source but I am wanting to present it in a way that I can't get it to work. I want to show what departments/user/and the count that are using specific URLs and put them on a single line with the corresponding URL.</P><P>Team1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;URL1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Count<BR />Team2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User4<BR />Team3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User9<BR />------------------------------------------------------------------------<BR />Team1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;URL2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Count<BR />Team4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User4<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User12<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User16<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User17<BR />------------------------------------------------------------------------<BR />Team3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;URL3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Count<BR />Team6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User3<BR />Team10&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User12<BR />------------------------------------------------------------------------<BR />Let me know if I need to clarify anything</P> Wed, 13 Mar 2024 01:04:51 GMT 1tiger105 2024-03-13T01:04:51Z Grouping data based off a single field https://community.splunk.com/t5/Splunk-Search/Grouping-data-based-off-a-single-field/m-p/680465#M232576 <P>I have all the relevant data I need from a single source but I am wanting to present it in a way that I can't get it to work. I want to show what departments/user/and the count that are using specific URLs and put them on a single line with the corresponding URL.</P><P>Team1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;URL1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Count<BR />Team2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User4<BR />Team3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User9<BR />------------------------------------------------------------------------<BR />Team1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;URL2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Count<BR />Team4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User4<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User12<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User16<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User17<BR />------------------------------------------------------------------------<BR />Team3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;URL3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Count<BR />Team6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User3<BR />Team10&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User12<BR />------------------------------------------------------------------------<BR />Let me know if I need to clarify anything</P> Wed, 13 Mar 2024 01:04:51 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-data-based-off-a-single-field/m-p/680465#M232576 1tiger105 2024-03-13T01:04:51Z Re: Grouping data based off a single field https://community.splunk.com/t5/Splunk-Search/Grouping-data-based-off-a-single-field/m-p/680467#M232577 <P>How do you envision Team and User aligned if they are both arrays? &nbsp;Your illustrated results suggests that you don't care about this part. &nbsp;If so, would this do?</P><LI-CODE lang="markup">| stats count values(Team) as Team values(User) as User by URL</LI-CODE> Wed, 13 Mar 2024 01:14:51 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-data-based-off-a-single-field/m-p/680467#M232577 yuanliu 2024-03-13T01:14:51Z Re: Grouping data based off a single field https://community.splunk.com/t5/Splunk-Search/Grouping-data-based-off-a-single-field/m-p/680468#M232578 <P>Didn't think that far ahead but Ill be making a dashboard for this so I think it would be easier if I separated them instead of trying to put it all in one search. What you just did works perfectly so thank you so much for that!&nbsp;</P> Wed, 13 Mar 2024 01:25:36 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-data-based-off-a-single-field/m-p/680468#M232578 1tiger105 2024-03-13T01:25:36Z