Splunk Search

How do you build a list of unique items in a field?

Marinus
Communicator

I'd like to build up a list of unique user id's that call a service.
If I use eval to just concatenate the next user id, I'd end up with duplicates.

eval userids=userid+","+userid
Tags (2)
0 Karma
1 Solution

ziegfried
Influencer

You could use multivalue fields:

 ... | stats values(userid) as userids | eval userids=mvjoin(userids,",")

View solution in original post

0 Karma

ziegfried
Influencer

You could use multivalue fields:

 ... | stats values(userid) as userids | eval userids=mvjoin(userids,",")
0 Karma

Marinus
Communicator

I ended up using eventstats rather than stats, thanks Ziegfried!

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...