topic Re: Grouping and Counting the Group Values in Splunk Search

Grouping and Counting the Group Values

kanda18 — Wed, 05 Feb 2014 20:10:40 GMT

Hello.
I have a requirement of presenting a table with Countries, users and the number of users in that country..
SO I have a query :
…{query}..| stats count values(user) by country

This will give me :

something like :

country User

USA-------u1

-------------u2

-------------u3

-------------u4

UK -------u5

-------------u6

What do I do to the query , so that it gives me the count of the number of users in the third column: something like :

country User UserCount

USA-------u1------ 4

-------------u2

-------------u3

-------------u4

UK -------u5----------2

-------------u6

Re: Grouping and Counting the Group Values

martin_mueller — Wed, 05 Feb 2014 20:12:29 GMT

Try this:

... | stats count values(user) dc(user) by country

Re: Grouping and Counting the Group Values

kanda18 — Wed, 05 Feb 2014 20:29:04 GMT

Thank you sir..

Re: Grouping and Counting the Group Values

kanda18 — Wed, 05 Feb 2014 23:17:03 GMT

Hey,
This works great on the splunk interface, but when I generate a report to be sent to an email, with the inline results, the users show on single line. In the splunk search, the table is neat, with the users on a new line. Is there a way to make sure that the splunk result shows in email as is ? with the new lines etc?I tried to do eval userNames=mvjoin(UsersMV,"#") .I think i need to do something to replace the # from the userNames and add a new line \n in regex? not sure. I am surprised that the results in the Splunk interface is different from the results in the email

Re: Grouping and Counting the Group Values

martin_mueller — Wed, 05 Feb 2014 23:27:14 GMT

Rendering in the UI and in an inline table of an email is inherently different. Off the top of my head you could try two things: You could mvexpand the values(user) field, giving you one copied event per user along with the counts... or you could indeed try to mvjoin() the users with a \n newline character... if that doesn't work, try joining them with an HTML <br> tag, provided Splunk isn't smart and replaces that with ampersand-entities.

If all that fails, you could create your own version of the sendemail.py script and build the inline tables as you need them.