How to create an iterative search

[timbCFCA]

I'm trying to correlate my printer entries along the top printer / user combination line.
What I'm looking for in the way of output would be something like:

printer name 1 | user name 1 | user name 1 count | user name 2 | user name 2 count | ... etc. 
printer name 2 | user name 3 | user name 3 count | user name 2 | user name 2 count | ... etc.

I have a search prepared to locate the printer names in the first column:

evtid=10 host=print1* OR host=print2* NOT evtuser=*$ | table Printer_Name | dedup Printer_Name

I also have a search that provides the data I want for the remaining columns:

evtid=10 host=print1* OR host=print2* NOT evtuser=*$ Printer_Name=PR-EAST | chart count by Printer_Name, evtuser

How do I glue these together to get the results I need? I'd rather not have to run hundreds of these queries by hand. I looked at subsearches and it doesn't look like that does quite what I need.

[tfletcher_splun · Accepted solution]

Do it all in one search try:

evtid=10 host=print1* OR host=print2* NOT evtuser=*$ Printer_Name=*| stats count by Printer_Name, evtuser | sort 0 Printer_Name, evtuser | stats list(evtuser) as users list(count) as counts by Printer_Name

This will give you each printer and then the users and counts in mv fileds. You can use further eval commands to pivot them into columns if you like. If you want one mv field just eval them together before final stats:

evtid=10 host=print1* OR host=print2* NOT evtuser=*$ Printer_Name=*| stats count by Printer_Name, evtuser | sort 0 Printer_Name, evtuser | eval data=evtuser+":"+count | stats list(data) as data by Printer_Name

Hope that helps!

[tfletcher_splun]

change the order in the sort pipeline to include count. (I assume you still want it by printer)
... | sort 0 Printer_Name, count, evtuser | ...

[timbCFCA]

How do I sort the output of the stats by the count statement?

[timbCFCA]

Perfect. I just wasn't sure what the necessary syntax was.