Splunk Search

How to get all items after count and get a list of items in an array?

mabinn
Explorer

Hi, what is the best way to get all items from a count? Let's say I have two columns. First column displays the items, second column displays how many were sold.

I want to create a third column that displays an array of receipt numbers according to items. Let's say that all receipts only had 1 item, so no duplication will happen.

items                            sold                                receipt_numbers
shampoo                        5                                     [123, 432, 654, 345, 664]
soap                                2                                     [112, 445]
razor                               1                                     [548]
cologne                           3                                     [765, 996, 273]

My current query is something like this

index=something source=xyz | dedup id | stats count(sold) by items
Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you want your stats to list all values of a field, tell it to: ... | stats count as sold, values(receipt_number) as receipt_numbers by items

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If you want your stats to list all values of a field, tell it to: ... | stats count as sold, values(receipt_number) as receipt_numbers by items

mabinn
Explorer

It doesn't need to be in array. I actually want to concat these receipt numbers later on using apendcols.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...