topic Re: count events in multivalue field in Splunk Search

count events in multivalue field

perlish — Mon, 18 Dec 2017 08:35:48 GMT

Hi,
I want to deal the multivalue field to get the counts whch is satisfied the conditions I set. For example, in the following picture, I want to get search result of (myfield>44) in one event.

Re: count events in multivalue field

andrey2007 — Mon, 18 Dec 2017 09:13:27 GMT

try this command
| eval n=mvcount(myfield)

Re: count events in multivalue field

kamlesh_vaghela — Mon, 18 Dec 2017 09:26:12 GMT

Can you please try this?

YOUR_SEARCH
| eval myfield=mvfilter(myfield>44) 
| eval n=mvcount(myfield)

My Sample search:

| makeresults 
| eval myfield="10,20,30,40" 
| makemv delim="," myfield 
| eval myfield=mvfilter(myfield>20) 
| eval n=mvcount(myfield)

Thanks

Re: count events in multivalue field

cmerriman — Mon, 18 Dec 2017 13:07:33 GMT

try this:

|eval myfield_count=mvcount(mvfilter(myfield>44))

Re: count events in multivalue field

perlish — Tue, 19 Dec 2017 04:55:08 GMT

It works,thank you!
While I have another question, it seems that splunk parse the float to string sometimes, and because of this problem, the mvfilter function may become invalid. How can I solve it in this situation?

Re: count events in multivalue field

perlish — Tue, 19 Dec 2017 04:56:24 GMT

Thanks! It works!

Re: count events in multivalue field

kamlesh_vaghela — Tue, 19 Dec 2017 08:03:26 GMT

Hih @perlish

Can you please share events or sample data which causes an error?

Re: count events in multivalue field

perlish — Wed, 20 Dec 2017 01:41:52 GMT

I'm sorry that I don't have the sample data. When I tried to solve the question I asked ,I used nomv() method and found that the single value's type is string. Therefore, I asked the following question.