Splunk Search

How to condense names and change to number?

darrenaefc
Engager

This is a very basic question. I have a set of data that gives me a list of groups and the names of each user in each group. instead of having the names per group I would like to have a number that represents the number of people in a group.

Eg. My table shows ID|GroupName

Under "ID" are users listed by their names EX. USER1, USER2,USER3,USER4 -- They all are a part of WindowsGRoup

I would like for it appear as ID=4 GroupName=WindowsGroup.... So when looking at the table you can see 4 users are apart of the Windows Group.

(I hope i explained that fine)

0 Karma

woodcock
Esteemed Legend

Take your existing search and add to it this:

... | stats dc(ID) AS IDcount values(ID) AS ID BY GroupName
0 Karma

darrenaefc
Engager

thank you so much!!!!!

0 Karma

woodcock
Esteemed Legend

If that solved it, be sure to come back and click Accept to close the question (and UpVote any other useful comments/answers).

0 Karma

woodcock
Esteemed Legend

@darrenaefc Come back and close the question!

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...