如何编写Splunk查询实现按指定字段分组并合并ClientApp为逗号列表

<my search_criteria> | stats sum(count) as total_count values(ClientApp) as ClientApps by Proxy, API, VERB | eval ClientApps = mvjoin(ClientApps, ", ")

• sum(count) as total_count：对同一Proxy、API、VERB分组下的count值求和，得到该分组的总请求数，用total_count作为字段名
• values(ClientApp) as ClientApps：提取分组内所有不重复的ClientApp值，生成一个多值字段
• mvjoin(ClientApps, ", ")：把多值的ClientApps字段转换为逗号分隔的字符串格式，便于查看

内容的提问来源于stack exchange，提问作者Paramesh Korrakuti