https://community.splunk.com/t5/Getting-Data-In/splitting-data-and-saving-the-each-result/m-p/199406#M39476 <P>oh ... my mistake! </P> <P>the table name is genre <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>thanks!</P> Fri, 10 Jan 2014 09:17:17 GMT changwoo 2014-01-10T09:17:17Z https://community.splunk.com/t5/Getting-Data-In/splitting-data-and-saving-the-each-result/m-p/199404#M39474 <P>i have raw data like </P> <OL> <LI><P>cat | dog | ele</P></LI> <LI><P>cat | dog </P></LI> <LI><P>dog | ele</P></LI> </OL> <P>this field name is catego<BR /> result should be counting like this =&gt; cat = 2, dog =3, ele =2 </P> <P>sourcetype=movie | eval n= split(genre,"|") |table count(n) by n &lt; = this is not splitting the string </P> Fri, 10 Jan 2014 08:18:17 GMT https://community.splunk.com/t5/Getting-Data-In/splitting-data-and-saving-the-each-result/m-p/199404#M39474 changwoo 2014-01-10T08:18:17Z https://community.splunk.com/t5/Getting-Data-In/splitting-data-and-saving-the-each-result/m-p/199405#M39475 <P>OK, some issues here.</P> <P>For one, the field name is catego, but in your search you use "genre"?<BR /> And then, <CODE>table</CODE> is no statistical command. It only shows the fields you supply as arguments. count(n) is no field, neither is "by".</P> <P>Maybe you want something like this:</P> <PRE><CODE>sourcetype=movie | eval n=split(catego,"|") | stats count by n </CODE></PRE> Fri, 10 Jan 2014 08:31:21 GMT https://community.splunk.com/t5/Getting-Data-In/splitting-data-and-saving-the-each-result/m-p/199405#M39475 Ayn 2014-01-10T08:31:21Z https://community.splunk.com/t5/Getting-Data-In/splitting-data-and-saving-the-each-result/m-p/199406#M39476 <P>oh ... my mistake! </P> <P>the table name is genre <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>thanks!</P> Fri, 10 Jan 2014 09:17:17 GMT https://community.splunk.com/t5/Getting-Data-In/splitting-data-and-saving-the-each-result/m-p/199406#M39476 changwoo 2014-01-10T09:17:17Z