Splunk Search

How to group results that has 5 or more distinct values in list(repo_name) ?

wailoont
Engager

Hi,

I have a search query as below.

query | stats list(repo_name) by user_login

This returns username with their repository listed grouped by the user_login.

For example :

Name Repository
user_login XXX

How can i enhance the query to only return searches ONLY if the list of repository has 5 or more values ?

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like this will work for you.

query | stats list(repo_name) as repo_names by user_login | where mvcount(repo_names) > 4
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like this will work for you.

query | stats list(repo_name) as repo_names by user_login | where mvcount(repo_names) > 4
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

wailoont
Engager

Many thanks. it works. 🙂

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!