Security

How to list page by user

user93
Communicator

I am a bit rusty on my Splunk search basics.

I have a userstats log. I need to list the values (contentId) for each userId in an exportable table. Basically, I want a list of all pages a user has visited. I want the list displayed by user. I only want the page listed once per user. If two users visit the same page the page needs to be listed for each user. If one user visits the same page twice, it needs to be listed only once for that user.

OUTPUT

user1 | pagexyz,pagewrx,pagetuv
user2 | pageabc,pagedef,pageghi
user3 | ....
user4...

The trouble I have is I want each to page item per user listed only once alphabetically. I don't want to dedup incorrectly and take a page user1 viewed from user2. I am specifying a large list of users hardcoded using a search macro.

What is the correct command?

Tags (3)
0 Karma
1 Solution

arjunpkishore5
Motivator

If you want the values of pages as a comma separated list use this.

|stats values(page) by user delim=","

If you just want a multivalue field, remove delim="," from the above list.

Hope this helps.

Cheers

View solution in original post

0 Karma

arjunpkishore5
Motivator

If you want the values of pages as a comma separated list use this.

|stats values(page) by user delim=","

If you just want a multivalue field, remove delim="," from the above list.

Hope this helps.

Cheers

0 Karma

user93
Communicator

thank you. I was trying the list command and forgot about the values command.

0 Karma

adonio
Ultra Champion

try this:
your search .... | stats values(page_field) as pages by user_field ...

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...