Getting Data In

How to get comma separated list of values?

moizmmz
Path Finder

Hi,

Here's my query:

index=uplynk slice_played isLive=1 channelID=8f88881faa334ab59484e999c6c5c318 | stats  dc(playerUserAgent) as "Count of Unique User Agents" by sessionID

This gives me a distinct count of playerUserAgent by sessionID. However, in the resulting statistics table, I not only want the sessionID and "Count of Unique User Agents", but also the comma separated values of playerUserAgent. I've tried using mv commands but with no success. Please help!

Tags (2)
1 Solution

sduff_splunk
Splunk Employee
Splunk Employee
index=uplynk slice_played isLive=1 channelID=8f88881faa334ab59484e999c6c5c318 | stats  dc(playerUserAgent) as "Count of Unique User Agents", values(playerUserAgent) as useragents by sessionID | eval useragents = mvjoin(useragents, ",")

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@moizmmz

Try this.

index=uplynk slice_played isLive=1 channelID=8f88881faa334ab59484e999c6c5c318 
| stats delim="," dc(playerUserAgent) as "Count of Unique User Agents", values(playerUserAgent) as useragents by sessionID 
| nomv useragents

Here, I have used delim in stats and nomv.

Ref:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/stats

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/nomv

moizmmz
Path Finder

This works too 🙂 thank you!!

0 Karma

moizmmz
Path Finder

Sorry I could only accept one answer. But I'll send you some points. Thanks for your help!

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee
index=uplynk slice_played isLive=1 channelID=8f88881faa334ab59484e999c6c5c318 | stats  dc(playerUserAgent) as "Count of Unique User Agents", values(playerUserAgent) as useragents by sessionID | eval useragents = mvjoin(useragents, ",")

moizmmz
Path Finder

This works! Thank you 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...