Splunk Search

Grouping and Counting the Group Values

kanda18
Explorer

Hello.
I have a requirement of presenting a table with Countries, users and the number of users in that country..
SO I have a query :
…{query}..| stats count values(user) by country

This will give me :

something like :

country User

USA-------u1

-------------u2

-------------u3

-------------u4

UK -------u5

-------------u6

What do I do to the query , so that it gives me the count of the number of users in the third column: something like :

country User UserCount

USA-------u1------ 4

-------------u2

-------------u3

-------------u4

UK -------u5----------2

-------------u6

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Try this:

... | stats count values(user) dc(user) by country

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Try this:

... | stats count values(user) dc(user) by country

martin_mueller
SplunkTrust
SplunkTrust

Rendering in the UI and in an inline table of an email is inherently different. Off the top of my head you could try two things: You could mvexpand the values(user) field, giving you one copied event per user along with the counts... or you could indeed try to mvjoin() the users with a \n newline character... if that doesn't work, try joining them with an HTML <br> tag, provided Splunk isn't smart and replaces that with ampersand-entities.

If all that fails, you could create your own version of the sendemail.py script and build the inline tables as you need them.

0 Karma

kanda18
Explorer

Hey,
This works great on the splunk interface, but when I generate a report to be sent to an email, with the inline results, the users show on single line. In the splunk search, the table is neat, with the users on a new line. Is there a way to make sure that the splunk result shows in email as is ? with the new lines etc?I tried to do eval userNames=mvjoin(UsersMV,"#") .I think i need to do something to replace the # from the userNames and add a new line \n in regex? not sure. I am surprised that the results in the Splunk interface is different from the results in the email

0 Karma

kanda18
Explorer

Thank you sir..

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...