Help with the logic to make this count my fields correctly

JRamirezEnosys — Thu, 24 Aug 2017 01:52:50 GMT

Hi, I have the following field called OS with 6 different values and count for each value:

Windows = 5
Mac = 4
Linux = 5
Mac, Windows = 10
Mac, Windows, Linux = 12
Mac, Linux = 11

The problem stand on that the real total of Windows values would be Windows,Windows+Mac,Windows,Linux (5+10+12)

So I would like to separate Mac,Windows into Windows and Mac values and add them to the Windows and Mac value.

At the end I would like to have something like:

Windows=27
Mac=26
Linux=16

My idea is to rename them twice but it doesn't really work out for me. Any ideas or solutions are welcome.

Cheers

Re: Help with the logic to make this count my fields correctly

somesoni2 — Thu, 24 Aug 2017 03:58:01 GMT

Give this a try

If you have field OS only showing the OS names and not the count.

your current search giving field OS and count
| makemv OS delim=","  | mvexpand OS | stats sum(count) as count by OS

If Windows = 5 is the actual full value for field OS, try this (extracting OS names and count)

your current search giving field OS with values like Windows = 5
| rex field=OS "(?<OS1>\S+)\s*\=(?<count>\d+)"
 | makemv OS1 delim=","  | mvexpand OS1 | stats sum(count) as count by OS1 | rename OS1 as OS

topic Re: Help with the logic to make this count my fields correctly in Getting Data In

Help with the logic to make this count my fields correctly

Re: Help with the logic to make this count my fields correctly