I am running a search to identify all users and the URLs they have connected to. The result includes duplicate users, but different URLs. I would like to dedup the users field, but have it list all URLs each user as connected to.
The results currently look like this:
User URLS
Mak Cnn.com
Mak Google.com
Mak Yahoo.com
Bam Aljazeera.com
Bam BBC.com
I would like it to look like this;
User URLS
Mak Cnn.com
Google.com
Yahoo.com
Bam Aljazeera.com
BBC.com
I hope this makes sense.
The current search is .... | table user src_user
. If I use the dedup value against the src_user, I lose all the URLs except for one that associates with each user returned in the dedup function.
Thanks,
| yourquery
| stats list(URLS) as URLS by User
Note that list won't do dedup on URLs, you can use values instead if you want this to happen:
| inputcsv mycsv.csv
| stats values(URLS) as URLS by User
Thanks Javiergn, it works.