- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
wailoont
Engager
04-14-2019
07:34 PM
Hi,
I have a search query as below.
query | stats list(repo_name) by user_login
This returns username with their repository listed grouped by the user_login.
For example :
Name Repository
user_login XXX
How can i enhance the query to only return searches ONLY if the list of repository has 5 or more values ?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
04-14-2019
07:47 PM
Perhaps something like this will work for you.
query | stats list(repo_name) as repo_names by user_login | where mvcount(repo_names) > 4
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
04-14-2019
07:47 PM
Perhaps something like this will work for you.
query | stats list(repo_name) as repo_names by user_login | where mvcount(repo_names) > 4
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
wailoont
Engager
04-14-2019
10:58 PM
Many thanks. it works. 🙂
