https://community.splunk.com/t5/Splunk-Search/How-to-create-an-iterative-search/m-p/39626#M9054 <P>How do I sort the output of the stats by the count statement?</P> Mon, 20 Aug 2012 18:28:13 GMT timbCFCA 2012-08-20T18:28:13Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-iterative-search/m-p/39623#M9051 <P>I'm trying to correlate my printer entries along the top printer / user combination line. <BR /> What I'm looking for in the way of output would be something like:</P> <PRE><CODE>printer name 1 | user name 1 | user name 1 count | user name 2 | user name 2 count | ... etc. printer name 2 | user name 3 | user name 3 count | user name 2 | user name 2 count | ... etc. </CODE></PRE> <P>I have a search prepared to locate the printer names in the first column:</P> <PRE><CODE>evtid=10 host=print1* OR host=print2* NOT evtuser=*$ | table Printer_Name | dedup Printer_Name </CODE></PRE> <P>I also have a search that provides the data I want for the remaining columns:</P> <PRE><CODE>evtid=10 host=print1* OR host=print2* NOT evtuser=*$ Printer_Name=PR-EAST | chart count by Printer_Name, evtuser </CODE></PRE> <P>How do I glue these together to get the results I need? I'd rather not have to run hundreds of these queries by hand. I looked at subsearches and it doesn't look like that does quite what I need. </P> Mon, 20 Aug 2012 18:15:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-iterative-search/m-p/39623#M9051 timbCFCA 2012-08-20T18:15:21Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-iterative-search/m-p/39624#M9052 <P>Do it all in one search try:</P> <PRE><CODE>evtid=10 host=print1* OR host=print2* NOT evtuser=*$ Printer_Name=*| stats count by Printer_Name, evtuser | sort 0 Printer_Name, evtuser | stats list(evtuser) as users list(count) as counts by Printer_Name </CODE></PRE> <P>This will give you each printer and then the users and counts in mv fileds. You can use further eval commands to pivot them into columns if you like. If you want one mv field just eval them together before final stats:</P> <PRE><CODE>evtid=10 host=print1* OR host=print2* NOT evtuser=*$ Printer_Name=*| stats count by Printer_Name, evtuser | sort 0 Printer_Name, evtuser | eval data=evtuser+":"+count | stats list(data) as data by Printer_Name </CODE></PRE> <P>Hope that helps!</P> Mon, 20 Aug 2012 18:23:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-iterative-search/m-p/39624#M9052 tfletcher_splun 2012-08-20T18:23:10Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-iterative-search/m-p/39625#M9053 <P>Perfect. I just wasn't sure what the necessary syntax was.</P> Mon, 20 Aug 2012 18:25:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-iterative-search/m-p/39625#M9053 timbCFCA 2012-08-20T18:25:02Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-iterative-search/m-p/39626#M9054 <P>How do I sort the output of the stats by the count statement?</P> Mon, 20 Aug 2012 18:28:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-iterative-search/m-p/39626#M9054 timbCFCA 2012-08-20T18:28:13Z https://community.splunk.com/t5/Splunk-Search/How-to-create-an-iterative-search/m-p/39627#M9055 <P>change the order in the sort pipeline to include count. (I assume you still want it by printer)<BR /> ... | sort 0 Printer_Name, count, evtuser | ...</P> Mon, 20 Aug 2012 19:40:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-an-iterative-search/m-p/39627#M9055 tfletcher_splun 2012-08-20T19:40:49Z