Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Combining Multivalues together inside a field
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I've got a field named "User" which holds the names of all the users of our service. Some users have similar names and I'd like to group them together in search outputs.
I'm creating a search to output the number of transactions by user.
source=index | chart count by User | rename count as "Transaction Count"
User | Transaction Count
ABC | 100
DEF | 300
GHI | 400
TEST | 5
TEST1 | 10
TEST12 | 20
TEST123 | 200
JKL | 300
MNO | 200
I'd like to group everything with "TEST" in the name together (they are the all the same user, but under similar userIDs), along with adding the values for each instance of "TEST" to create a new multivalue called "TEST" (see below).
User | Transaction Count
ABC | 100
DEF | 300
GHI | 400
TEST | 235
JKL | 300
MNO | 200
Can anybody help me? Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you don't care about keeping all the test accounts separate, I would use rex to rename them at search time. Something like this should work:
| rex field=User mode=sed "s/(TEST).*/\1/" | chart count by User
This assumes that no legitimate user account will have the word TEST in it, so depending on your data you may have to tweak the regex a bit.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you don't care about keeping all the test accounts separate, I would use rex to rename them at search time. Something like this should work:
| rex field=User mode=sed "s/(TEST).*/\1/" | chart count by User
This assumes that no legitimate user account will have the word TEST in it, so depending on your data you may have to tweak the regex a bit.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thankyou so much!! 🙂
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
