Getting Data In

How to get comma separated list of values?

moizmmz
Path Finder

Hi,

Here's my query:

index=uplynk slice_played isLive=1 channelID=8f88881faa334ab59484e999c6c5c318 | stats  dc(playerUserAgent) as "Count of Unique User Agents" by sessionID

This gives me a distinct count of playerUserAgent by sessionID. However, in the resulting statistics table, I not only want the sessionID and "Count of Unique User Agents", but also the comma separated values of playerUserAgent. I've tried using mv commands but with no success. Please help!

Tags (2)
1 Solution

sduff_splunk
Splunk Employee
Splunk Employee
index=uplynk slice_played isLive=1 channelID=8f88881faa334ab59484e999c6c5c318 | stats  dc(playerUserAgent) as "Count of Unique User Agents", values(playerUserAgent) as useragents by sessionID | eval useragents = mvjoin(useragents, ",")

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@moizmmz

Try this.

index=uplynk slice_played isLive=1 channelID=8f88881faa334ab59484e999c6c5c318 
| stats delim="," dc(playerUserAgent) as "Count of Unique User Agents", values(playerUserAgent) as useragents by sessionID 
| nomv useragents

Here, I have used delim in stats and nomv.

Ref:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/stats

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/nomv

moizmmz
Path Finder

This works too 🙂 thank you!!

0 Karma

moizmmz
Path Finder

Sorry I could only accept one answer. But I'll send you some points. Thanks for your help!

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee
index=uplynk slice_played isLive=1 channelID=8f88881faa334ab59484e999c6c5c318 | stats  dc(playerUserAgent) as "Count of Unique User Agents", values(playerUserAgent) as useragents by sessionID | eval useragents = mvjoin(useragents, ",")

moizmmz
Path Finder

This works! Thank you 🙂

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...