Splunk Search

How do you build a list of unique items in a field?

Communicator

I'd like to build up a list of unique user id's that call a service.
If I use eval to just concatenate the next user id, I'd end up with duplicates.

eval userids=userid+","+userid
Tags (2)
0 Karma
1 Solution

Influencer

You could use multivalue fields:

 ... | stats values(userid) as userids | eval userids=mvjoin(userids,",")

View solution in original post

0 Karma

Influencer

You could use multivalue fields:

 ... | stats values(userid) as userids | eval userids=mvjoin(userids,",")

View solution in original post

0 Karma

Communicator

I ended up using eventstats rather than stats, thanks Ziegfried!

0 Karma