Hello.
I have a requirement of presenting a table with Countries, users and the number of users in that country..
SO I have a query :
…{query}..| stats count values(user) by country
This will give me :
something like :
country User
USA-------u1
-------------u2
-------------u3
-------------u4
UK -------u5
-------------u6
What do I do to the query , so that it gives me the count of the number of users in the third column: something like :
country User UserCount
USA-------u1------ 4
-------------u2
-------------u3
-------------u4
UK -------u5----------2
-------------u6
Try this:
... | stats count values(user) dc(user) by country
Rendering in the UI and in an inline table of an email is inherently different. Off the top of my head you could try two things: You could mvexpand
the values(user) field, giving you one copied event per user along with the counts... or you could indeed try to mvjoin() the users with a \n newline character... if that doesn't work, try joining them with an HTML <br> tag, provided Splunk isn't smart and replaces that with ampersand-entities.
If all that fails, you could create your own version of the sendemail.py script and build the inline tables as you need them.
Hey,
This works great on the splunk interface, but when I generate a report to be sent to an email, with the inline results, the users show on single line. In the splunk search, the table is neat, with the users on a new line. Is there a way to make sure that the splunk result shows in email as is ? with the new lines etc?I tried to do eval userNames=mvjoin(UsersMV,"#") .I think i need to do something to replace the # from the userNames and add a new line \n in regex? not sure. I am surprised that the results in the Splunk interface is different from the results in the email
Thank you sir..