Security

How to list page by user

Path Finder

I am a bit rusty on my Splunk search basics.

I have a userstats log. I need to list the values (contentId) for each userId in an exportable table. Basically, I want a list of all pages a user has visited. I want the list displayed by user. I only want the page listed once per user. If two users visit the same page the page needs to be listed for each user. If one user visits the same page twice, it needs to be listed only once for that user.

OUTPUT

user1 | pagexyz,pagewrx,pagetuv
user2 | pageabc,pagedef,pageghi
user3 | ....
user4...

The trouble I have is I want each to page item per user listed only once alphabetically. I don't want to dedup incorrectly and take a page user1 viewed from user2. I am specifying a large list of users hardcoded using a search macro.

What is the correct command?

Tags (3)
0 Karma
1 Solution

Motivator

If you want the values of pages as a comma separated list use this.

|stats values(page) by user delim=","

If you just want a multivalue field, remove delim="," from the above list.

Hope this helps.

Cheers

View solution in original post

0 Karma

Motivator

If you want the values of pages as a comma separated list use this.

|stats values(page) by user delim=","

If you just want a multivalue field, remove delim="," from the above list.

Hope this helps.

Cheers

View solution in original post

0 Karma

Path Finder

thank you. I was trying the list command and forgot about the values command.

0 Karma

SplunkTrust
SplunkTrust

try this:
your search .... | stats values(page_field) as pages by user_field ...

0 Karma