Count values of grouped key

[dav_muel]

I have logs like this:

user=userA ip=1.1.1.1 ...
user=userA ip=1.1.1.2 ...
user=userB ip=1.1.2.1 ...
user=userB ip=1.1.2.1 ...
user=userC ip=1.1.3.1 ...
user=userC ip=1.1.3.2 ...
user=userC ip=1.1.3.3 ...

Now I want to have a list of all users with their IPs and the count of the different IPs.

First I do this:

======
search foobar
| stats values(user) by ip
======

Result is:

userA	1.1.1.1 1.1.1.2
userB	1.1.2.1
userC	1.1.3.1 1.1.3.2 1.1.3.3

How do I count and display the IPs? It should look like this:

userA	1.1.1.1 1.1.1.2	2
userB	1.1.2.1	1
userC	1.1.3.1 1.1.3.2 1.1.3.3	3

[inventsekar]

base search | stats dc(ip) as IP_COUNT values(ip) as ip_list by User

[somesoni2]

You can call multiple function in stats. Like this

search foobar
| stats values(ip) as ips_used dc(ips) as ips_count by user

[rnowitzki · Accepted solution]

Hi @dav_muel ,

This should work:

search foobar
| stats values(ip) as ips by user
| eval ipcount=mvcount(ips)

 
BR
Ralph