Grouping and Counting the Group Values

[kanda18]

Hello.
I have a requirement of presenting a table with Countries, users and the number of users in that country..
SO I have a query :
…{query}..| stats count values(user) by country

This will give me :

something like :

country User

USA-------u1

-------------u2

-------------u3

-------------u4

UK -------u5

-------------u6

What do I do to the query , so that it gives me the count of the number of users in the third column: something like :

country User UserCount

USA-------u1------ 4

-------------u2

-------------u3

-------------u4

UK -------u5----------2

-------------u6

[martin_mueller · Accepted solution]

Try this:

... | stats count values(user) dc(user) by country

[martin_mueller]

Rendering in the UI and in an inline table of an email is inherently different. Off the top of my head you could try two things: You could mvexpand the values(user) field, giving you one copied event per user along with the counts... or you could indeed try to mvjoin() the users with a \n newline character... if that doesn't work, try joining them with an HTML <br> tag, provided Splunk isn't smart and replaces that with ampersand-entities.

If all that fails, you could create your own version of the sendemail.py script and build the inline tables as you need them.

[kanda18]

Hey,
This works great on the splunk interface, but when I generate a report to be sent to an email, with the inline results, the users show on single line. In the splunk search, the table is neat, with the users on a new line. Is there a way to make sure that the splunk result shows in email as is ? with the new lines etc?I tried to do eval userNames=mvjoin(UsersMV,"#") .I think i need to do something to replace the # from the userNames and add a new line \n in regex? not sure. I am surprised that the results in the Splunk interface is different from the results in the email

[kanda18]

Thank you sir..