Archive

How to condense names and change to number?

Engager

This is a very basic question. I have a set of data that gives me a list of groups and the names of each user in each group. instead of having the names per group I would like to have a number that represents the number of people in a group.

Eg. My table shows ID|GroupName

Under "ID" are users listed by their names EX. USER1, USER2,USER3,USER4 -- They all are a part of WindowsGRoup

I would like for it appear as ID=4 GroupName=WindowsGroup.... So when looking at the table you can see 4 users are apart of the Windows Group.

(I hope i explained that fine)

0 Karma

Esteemed Legend

Take your existing search and add to it this:

... | stats dc(ID) AS IDcount values(ID) AS ID BY GroupName
0 Karma

Engager

thank you so much!!!!!

0 Karma

Esteemed Legend

If that solved it, be sure to come back and click Accept to close the question (and UpVote any other useful comments/answers).

0 Karma

Esteemed Legend

@darrenaefc Come back and close the question!

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!