Dashboards & Visualizations

group results in a form

lancealotx
Explorer

Same as some others trying to grasp my understanding on how the language works. Well I have a bunch of data based on specific points. I want the user to enter a number, have it return the following;

the member of the user that hit it (grouped by this) along with the apikey, nothing else right now.

I have my form that prompts for an ID, when hit, I get ALL the data, but nothing grouped, and I did try a bunch of ways; here is the form;

<form>
  <label>Unique Users by Spot</label>
  <searchTemplate>
    member !=-1 AND (ApiKey="123" OR ApiKey="456" OR ApiKey="789" OR ApiKey="abc")  
    spotId=$Spot Id$ 
    | fields memberId ApiKey
  </searchTemplate>
  <fieldset>
      <input type="text" token="Spot Id" />
      <input type="time" />
  </fieldset>
  <row>
       <table>
          <option name="showpager">false</option>
          <option name="count">50</option>
     </table>
  </row>
</form>

Sample results is;

1 8/6/12 9:55:00.826 PM 229424 abc
2 8/5/12 7:30:51.661 PM 273755 123
3 8/5/12 3:44:17.216 PM 229424 abc

the _raw is also displayed, but row's 1 and 3 are the same user (229424) so I would like to group on that. Tnx

Tags (3)
0 Karma

reed_kelly
Contributor

After "fields memberId ApiKey" just add:

|dedup memberId, ApiKey |table memberId, ApiKey
0 Karma

reed_kelly
Contributor

In that case, you can replace the fields, dedup and table commands with:
|stats count by memberId, ApiKey

The blanks for ApiKey are strange, because you are testing for that above. You can always leave it off the stats command.

0 Karma

lancealotx
Explorer

Thanks, when I tried that, I ended with no results found. I did play a bit get some results by ending with this;

|fields memberId ApiKey |dedup memberId|table memberId, ApiKey

That gives me 5 rows of data (which seems correct) with the 5 members that hit that spot. The api key however is blank. The api key is how their getting to us (website, iphone, android), so a user could have multiple, but all of that column is blank. I don't care so much (right now) about how, that will be later, right now I would like to know in the timeframe;

user: 12345 10 times
user: 56778 5 times

0 Karma
Get Updates on the Splunk Community!

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...