Getting Data In

How to get comma separated list of values?

Path Finder

Hi,

Here's my query:

index=uplynk slice_played isLive=1 channelID=8f88881faa334ab59484e999c6c5c318 | stats  dc(playerUserAgent) as "Count of Unique User Agents" by sessionID

This gives me a distinct count of playerUserAgent by sessionID. However, in the resulting statistics table, I not only want the sessionID and "Count of Unique User Agents", but also the comma separated values of playerUserAgent. I've tried using mv commands but with no success. Please help!

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee
index=uplynk slice_played isLive=1 channelID=8f88881faa334ab59484e999c6c5c318 | stats  dc(playerUserAgent) as "Count of Unique User Agents", values(playerUserAgent) as useragents by sessionID | eval useragents = mvjoin(useragents, ",")

View solution in original post

SplunkTrust
SplunkTrust

@moizmmz

Try this.

index=uplynk slice_played isLive=1 channelID=8f88881faa334ab59484e999c6c5c318 
| stats delim="," dc(playerUserAgent) as "Count of Unique User Agents", values(playerUserAgent) as useragents by sessionID 
| nomv useragents

Here, I have used delim in stats and nomv.

Ref:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/stats

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/nomv

Path Finder

This works too 🙂 thank you!!

0 Karma

Path Finder

Sorry I could only accept one answer. But I'll send you some points. Thanks for your help!

0 Karma

Splunk Employee
Splunk Employee
index=uplynk slice_played isLive=1 channelID=8f88881faa334ab59484e999c6c5c318 | stats  dc(playerUserAgent) as "Count of Unique User Agents", values(playerUserAgent) as useragents by sessionID | eval useragents = mvjoin(useragents, ",")

View solution in original post

Path Finder

This works! Thank you 🙂

0 Karma