https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263104#M78956 <P>Give this a try as well (may be little faster)</P> <PRE><CODE>index=main | stats values(Proj_repo) as Projects by Author | eventstats values(Author) as Team by Projects | stats values(Team) as Team by Author | eval MemberCount=mvcount(Team) </CODE></PRE> Tue, 24 May 2016 17:04:39 GMT somesoni2 2016-05-24T17:04:39Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263099#M78951 <P>I have the following search:</P> <PRE><CODE>index="main" |rename Proj_repo AS Project | multireport [ stats values(Project) AS Projects BY Author ][ stats values(Author) AS Team BY Project ] </CODE></PRE> <P>that provides a combined result set for which I need to search each Author against Team to get a combined set of Team values for the author (in other words, everyone the author has worked with).</P> <P>I've tried various forms of <STRONG>foreach</STRONG> and <STRONG>map</STRONG>, but to no avail. I've additionally tried comma delimiting the Team values since it's a mutlivalue field.</P> <P>Suggestions on how to search the results of the multireport? Thanks!</P> Tue, 24 May 2016 15:44:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263099#M78951 jlkokko 2016-05-24T15:44:12Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263100#M78952 <P>Give this a try</P> <PRE><CODE>index=main | stats count by Proj_repo Author |rename Proj_repo AS Project | eventstats values(Author) as Authors by Project | stats values(Authors) as Team by Author </CODE></PRE> Tue, 24 May 2016 16:04:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263100#M78952 somesoni2 2016-05-24T16:04:09Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263101#M78953 <P><STRONG>Exactly</STRONG> what I needed. Can you explain the need for stats count? I'm not sure I understand its use in the equation.</P> Tue, 24 May 2016 16:09:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263101#M78953 jlkokko 2016-05-24T16:09:07Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263102#M78954 <P>As the first count is not displayed, I simplified it a bit and added the counts on the end:</P> <PRE><CODE>index=main | eventstats values(Author) as Authors by Proj_repo | stats values(Authors) as Team by Author | eval People = mvcount(Team) </CODE></PRE> Tue, 24 May 2016 16:21:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263102#M78954 jlkokko 2016-05-24T16:21:10Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263103#M78955 <P>The stats count was to remove the duplicate combination of Project and Author. You can use dedup command as well. I generally prefer to remove unwanted results as soon as possible, to avoid extra processing.</P> Tue, 24 May 2016 17:02:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263103#M78955 somesoni2 2016-05-24T17:02:46Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263104#M78956 <P>Give this a try as well (may be little faster)</P> <PRE><CODE>index=main | stats values(Proj_repo) as Projects by Author | eventstats values(Author) as Team by Projects | stats values(Team) as Team by Author | eval MemberCount=mvcount(Team) </CODE></PRE> Tue, 24 May 2016 17:04:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263104#M78956 somesoni2 2016-05-24T17:04:39Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263105#M78957 <P>Do you have a link to the documentation on multireport? I don't see it here: <A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/WhatsInThisManual">https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/WhatsInThisManual</A></P> Tue, 31 Dec 2019 20:14:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263105#M78957 landen99 2019-12-31T20:14:29Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263106#M78958 <P>multireport is unlikely to be documented unfortunately, they are more likely to create a new search command...</P> Thu, 02 Jan 2020 08:54:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-results-produced-by-the-multireport-command/m-p/263106#M78958 gjanders 2020-01-02T08:54:01Z