Splunk Search

How to group results that has 5 or more distinct values in list(repo_name) ?

wailoont
Engager

Hi,

I have a search query as below.

query | stats list(repo_name) by user_login

This returns username with their repository listed grouped by the user_login.

For example :

Name Repository
user_login XXX

How can i enhance the query to only return searches ONLY if the list of repository has 5 or more values ?

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like this will work for you.

query | stats list(repo_name) as repo_names by user_login | where mvcount(repo_names) > 4
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like this will work for you.

query | stats list(repo_name) as repo_names by user_login | where mvcount(repo_names) > 4
---
If this reply helps you, Karma would be appreciated.
0 Karma

wailoont
Engager

Many thanks. it works. 🙂

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...