- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: I need to combine two results names into one
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So search command | stats count by user | want to rename or combine the two results into same name
i.e.
User ** **Count
eid 1234abc 2
Bobbie Smith 12
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'll try it. Thanks for the help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, I'll try that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this:
eval UserCount = User.Count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming you'll not always get two rows from your stats, how do you relate a name with user_id? Do you've any lookup or any other source which contains this mapping?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't know what you are asking. The results show up as a user ID, then the user name appears in the table value as well. I have several that show up as both name and eID, which I need to combine them for alert reporting purposes. The count shows them both as well.
User Count
Bobbie Smith 12
eID 1234abc . (Also Bobbie Smith) 2
Not sure if the format for the tables and columns are showing up well enough.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@streetdoc123 - @somesoni2 is asking, "How will the search program determine which user name goes with which id?"
Is there a table somewhere that has...
eid Name
1234abc Bobbie Smith
2345def J Jonah Jamieson
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is this a multi value field? Can you provide syntax that is getting you to this point ?
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
Splunk APM: New Product Features + Community Office Hours Recap!
Index This | Forward, I’m heavy; backward, I’m not. What am I?
