https://community.splunk.com/t5/Splunk-Search/List-of-users-sharing-files/m-p/110041#M28732 <P>I am looking to get a list of unique users who share files. The logs have an entry when a file is accessed with the FileID and the UserID. Doing something like <STRONG>.....| stats dc(UserID) AS UserCount by FileID | where UserCount&gt;1</STRONG> gives me the number of files that are shared (more than 1 user accessed it), but I don't quite know how to extract the list of distinct UserIDs from that list. I've tried chart, but with a large number of users (&gt;10,000) it produces a huge number of columns and seems to crash. i'm really just after the count of unique UserIDs, so if there is a way to produce just that number and avoid a huge table output that would be very helpful. Thanks!</P> Sun, 12 Jan 2014 23:40:47 GMT fuzzy_rocks 2014-01-12T23:40:47Z https://community.splunk.com/t5/Splunk-Search/List-of-users-sharing-files/m-p/110041#M28732 <P>I am looking to get a list of unique users who share files. The logs have an entry when a file is accessed with the FileID and the UserID. Doing something like <STRONG>.....| stats dc(UserID) AS UserCount by FileID | where UserCount&gt;1</STRONG> gives me the number of files that are shared (more than 1 user accessed it), but I don't quite know how to extract the list of distinct UserIDs from that list. I've tried chart, but with a large number of users (&gt;10,000) it produces a huge number of columns and seems to crash. i'm really just after the count of unique UserIDs, so if there is a way to produce just that number and avoid a huge table output that would be very helpful. Thanks!</P> Sun, 12 Jan 2014 23:40:47 GMT https://community.splunk.com/t5/Splunk-Search/List-of-users-sharing-files/m-p/110041#M28732 fuzzy_rocks 2014-01-12T23:40:47Z https://community.splunk.com/t5/Splunk-Search/List-of-users-sharing-files/m-p/110042#M28733 <P>The stats command <CODE>values()</CODE> does this.</P> <PRE><CODE>... | stats dc(UserID) AS UserCount, values(UserID) as UniqueUsers by FileID | ... </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions</A></P> Mon, 13 Jan 2014 07:34:56 GMT https://community.splunk.com/t5/Splunk-Search/List-of-users-sharing-files/m-p/110042#M28733 Ayn 2014-01-13T07:34:56Z https://community.splunk.com/t5/Splunk-Search/List-of-users-sharing-files/m-p/110043#M28734 <P>Thanks - exactly what I was looking for!</P> Tue, 14 Jan 2014 05:27:02 GMT https://community.splunk.com/t5/Splunk-Search/List-of-users-sharing-files/m-p/110043#M28734 fuzzy_rocks 2014-01-14T05:27:02Z