Splunk Search

How do you build a list of unique items in a field?

Marinus
Communicator

I'd like to build up a list of unique user id's that call a service.
If I use eval to just concatenate the next user id, I'd end up with duplicates.

eval userids=userid+","+userid
Tags (2)
0 Karma
1 Solution

ziegfried
Influencer

You could use multivalue fields:

 ... | stats values(userid) as userids | eval userids=mvjoin(userids,",")

View solution in original post

0 Karma

ziegfried
Influencer

You could use multivalue fields:

 ... | stats values(userid) as userids | eval userids=mvjoin(userids,",")
0 Karma

Marinus
Communicator

I ended up using eventstats rather than stats, thanks Ziegfried!

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...