How to return multivalue result from subsearch that begins with 'stats count'

[evelenke]

Hi, Splunkers

I have pie chart with simple stats by fullname concatenated with bunit ("John Doe; Marketing",...).
Each user may have several assets linked to him in an asset lookup table.
So in driildown table I need to retrieve all IP addresses (hostnames) for 'klicked' user, e.g.:

| stats count| eval person="John Doe; Marketing"  | rex field=person "(?<fullname>[^\;]+)" | lookup asset_lookup fullname as fullname OUTPUT ip host

It only retrieves the first matching result.
How can I get all results?

[evelenke]

Thanks guys, need to show up what I need - multivalue field ip for my user :

fullname   ip 
John Doe  10.0.0.1
          10.0.0.2
          10.0.0.3
Jane Doe  10.4.1.1
          10.4.1.3

I don't need bunit part in output

[javiergn]

Two things:

• Isn't my query below already returning multivalued IP for your users when they match more than 1 IP? If not, have you restricted "Maximum matches" in your lookup advanced configuration to 1 (note this is the default for time-based lookups)?
• If you also want to summarise by fullname in the same way as you are explaining above, simply append | stats values(ip) as ip by fullname to your query. I've fixed my answers below to reflect this

[evelenke]

That's it! The "Maximum matches" was restricted to 1 (how could I miss this point) , thank you!

[javiergn · Accepted solution]

Like this:

| stats count
| eval person="John Doe; Marketing" 
| rex max_match=0 field=person "(?<fullname>[^\;]+)"
| lookup asset_lookup fullname as fullname OUTPUT ip host
| stats values(ip) as ip by fullname

Or this:

| stats count
| eval person="John Doe; Marketing" 
| eval fullname = split(person, ";")
| lookup asset_lookup fullname as fullname OUTPUT ip host
| stats values(ip) as ip by fullname