https://community.splunk.com/t5/Getting-Data-In/How-to-get-total-comma-separated-values-in-splunk/m-p/406158#M72046 <P>can you share one sample event of your raw data?<BR /> Also try this</P> <PRE><CODE>index="" var=* | head 1 | table val | rex field=val mode=sed "s/val\=//g" </CODE></PRE> <P>let me know if this helps!</P> Tue, 22 May 2018 09:14:19 GMT mayurr98 2018-05-22T09:14:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-total-comma-separated-values-in-splunk/m-p/406155#M72043 <P>Hi all,</P> <P>I am getting event like this <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/4985iF386FD6C54B34D98/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Im trying to get total values with the comma separated but I am not getting them.</P> <P>I have written this basic query: </P> <PRE><CODE>index="****" var=***| head 1 | table val </CODE></PRE> <P>But it is not working, please help me out.</P> Tue, 22 May 2018 07:26:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-total-comma-separated-values-in-splunk/m-p/406155#M72043 ajayabburi508 2018-05-22T07:26:00Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-total-comma-separated-values-in-splunk/m-p/406156#M72044 <P>For the example event you showed us - what would be your desired result? </P> Tue, 22 May 2018 07:44:48 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-total-comma-separated-values-in-splunk/m-p/406156#M72044 xpac 2018-05-22T07:44:48Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-total-comma-separated-values-in-splunk/m-p/406157#M72045 <P>i want out put like this </P> <P>val<BR /> 972,972,972,972,972,972,972,972..............................</P> Tue, 22 May 2018 07:48:41 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-total-comma-separated-values-in-splunk/m-p/406157#M72045 ajayabburi508 2018-05-22T07:48:41Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-total-comma-separated-values-in-splunk/m-p/406158#M72046 <P>can you share one sample event of your raw data?<BR /> Also try this</P> <PRE><CODE>index="" var=* | head 1 | table val | rex field=val mode=sed "s/val\=//g" </CODE></PRE> <P>let me know if this helps!</P> Tue, 22 May 2018 09:14:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-total-comma-separated-values-in-splunk/m-p/406158#M72046 mayurr98 2018-05-22T09:14:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-total-comma-separated-values-in-splunk/m-p/406159#M72047 <PRE><CODE>index="****" var=***| head 1|eval new=_raw | eval neew=split(new,"var=***,val=")| table neew | makemv delim="," neew|mvexpand neew |streamstats count | where count!=1 | fields - count </CODE></PRE> Tue, 22 May 2018 11:05:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-total-comma-separated-values-in-splunk/m-p/406159#M72047 ajayabburi508 2018-05-22T11:05:16Z