For each subject in the search sentence, the count number is displayed.
In addition to the information currently being displayed, I want to display the attached file name for each subject.
The search sentence you are using is below.
※ Partially omitted
index=xxxxx
| lookup ~ommitted~
| stats count ~ommitted~ by subject
Can I display the attached file name by adding it to the search sentence that is counting?
-image table-
Subject---Number---attached file name---Number of Mail with Attachment
AAAA---100--- aaaa---10
BBBB---50---none---0
CCCC---200---cccc---200
In the current search searches, only the subject line and number of items are displayed.
*I want to display none if there is no attached file.
index=xxxxx
| lookup ~ommitted~
| stats count values("attached file name") ~ommitted~ by subject
Or list("attached file name")
would work too. List gets you ALL of the values in order, values gets something more like a distinct list of file names. You can try both and see which fits your needs better.
Happy Splunking,
Rich
index=xxxxx
| lookup ~ommitted~
| stats count values("attached file name") ~ommitted~ by subject
Or list("attached file name")
would work too. List gets you ALL of the values in order, values gets something more like a distinct list of file names. You can try both and see which fits your needs better.
Happy Splunking,
Rich
Thanks to your answer, I was able to solve the problem.