Splunk Search

Sort and Grouping Question

lemikg
Communicator

Hi Splunkers,

this might sound stupid. I am trying to query and table host, COMMAND and USER which works fine. But is it possible to group the host? I want to display each COMMAND and USER value under one host name.


Host COMMAND USER
www.off.dus.acompany.com ini_t root
kthreadt root
ksoftirqd root
migration root
watdog/0 root
mirtion/1 root
ksoftqd/1 root
www.off.ber.bcompany.com ini_t root
kthreadt root
ksoftirqd root
migration root
watdog/0 root
mirtion/1 root
ksoftqd/1 root

This is all I got

sourcetype=pu OR sourcetype=tik COMMAND | multikv | table host COMMAND USER

In terms of visuals it is almost the same case as the following link

http://splunk-base.splunk.com/answers/25102/question-regarding-grouping-of-results-into-a-table

Thanks in advance for your help.

Best regards
Mike

0 Karma
1 Solution

Paolo_Prigione
Builder

| stats list() will keep duplicate user-command tuples.

sourcetype=pu OR sourcetype=tik COMMAND 
| multikv  
| strcat "[" USER "] " COMMAND user_command
| stats list(user_command) by host

View solution in original post

Paolo_Prigione
Builder

| stats list() will keep duplicate user-command tuples.

sourcetype=pu OR sourcetype=tik COMMAND 
| multikv  
| strcat "[" USER "] " COMMAND user_command
| stats list(user_command) by host

Paolo_Prigione
Builder

replace "| stats list(user_command) by host" with "| stats list(user_command) count dc(user_command) as distinct_count by host"

0 Karma

lemikg
Communicator

btw how do I now count the values in the field list(user_command)?

0 Karma

lemikg
Communicator

Perfect! Thank you very much!!!

0 Karma

yannK
Splunk Employee
Splunk Employee

Not very nice, but you can group the COMMAND and USER on a single columns and try the commands values().

mysearch | eval command_user= COMMAND." ".USER
| stats values(command_user) AS list_command_user by host

But the duplicates will be removed, so if you really need the count, add some magic.

mysearch | eval command_user= COMMAND." ".USER
| stats count by command_user host
| eval command_user_count=command_user." [".count."]"
| stats values(command_user_count) AS list_command_user_count by host

0 Karma

lemikg
Communicator

thanks, i copy&pasted eval command_user= COMMAND." ".USER
| stats values(command_user) AS list_command_user by host. But it shows only the hosts. Is there anything I need to do else?

0 Karma

MHibbin
Influencer
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...