Splunk Search

How to get all items after count and get a list of items in an array?

mabinn
Explorer

Hi, what is the best way to get all items from a count? Let's say I have two columns. First column displays the items, second column displays how many were sold.

I want to create a third column that displays an array of receipt numbers according to items. Let's say that all receipts only had 1 item, so no duplication will happen.

items                            sold                                receipt_numbers
shampoo                        5                                     [123, 432, 654, 345, 664]
soap                                2                                     [112, 445]
razor                               1                                     [548]
cologne                           3                                     [765, 996, 273]

My current query is something like this

index=something source=xyz | dedup id | stats count(sold) by items
Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you want your stats to list all values of a field, tell it to: ... | stats count as sold, values(receipt_number) as receipt_numbers by items

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If you want your stats to list all values of a field, tell it to: ... | stats count as sold, values(receipt_number) as receipt_numbers by items

mabinn
Explorer

It doesn't need to be in array. I actually want to concat these receipt numbers later on using apendcols.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...