topic Count values in multivalue field encoded as a string in Splunk Search

Count values in multivalue field encoded as a string

brinley — Wed, 30 Sep 2020 01:30:07 GMT

I have the following entry in several of my events:

puppy_name = "Scout Windixie Spot"

If it's not obvious already, this field, puppy_name, has 3 different values. It really should be:

puppy_names = ["Scout", "Windixie", "Spot"]

That said, I have a couple of questions:
Note if you can help me with question 2, then don't bother with 1
1) What spl query can I construct to count the number of unique strings in puppy_name and put the result in a new field called puppy_name_count?
I have already tried:

index="puppies" | eval puppy_name_count=mvcount(split(puppy_name, " "))

Assuming split() returns an array (although I can't say this for sure because I couldn't find any documentation on split()), I need something like:

index="puppies" | eval puppy_name_count=array_length(split(puppy_name, " "))

Does anyone know how I can achieve this?

2) Is there an spl query or splunk configuration I can write to automatically split in the different puppy names in puppy_name into something like: puppys_name=["Scout", "Windixie", "Spot"]?

Re: Count values in multivalue field encoded as a string

starcher — Wed, 24 Jul 2019 19:52:23 GMT

This does work. So if that isn't working in your data then you have some hidden character.

| makeresults 
| eval puppy_name = "Scout Windixie Spot" 
| eval nameCount=mvcount(split(puppy_name," "))

Play around with field extraction to break them up similar to

| makeresults 
| eval puppy_name = "Scout Windixie Spot" 
| rex field=puppy_name max_match=0 "(?P<puppy_names>[^\s\r\n]+)" 
| eval nameCount=mvcount(split(puppy_names," "))

Re: Count values in multivalue field encoded as a string

vnravikumar — Thu, 25 Jul 2019 03:42:56 GMT

Hi @brinley

Check this

To find the number of unique strings:

    | makeresults 
    | eval puppy_name = "Scout Windixie Spot Scout" 
    | makemv delim=" " puppy_name 
    | eval puppy_name_count =mvcount(mvdedup(puppy_name)) 
    | table puppy_name_count

String in the required format:

| makeresults 
| eval puppy_name = "Scout Windixie Spot Scout" 
| makemv delim=" " puppy_name 
| eval puppy_name =mvdedup(puppy_name) 
| mvexpand puppy_name 
| eval puppy_name = "\"".puppy_name."\"" 
| mvcombine puppy_name delim="," 
| nomv puppy_name 
| eval puppy_name = "[".puppy_name."]" 
| table puppy_name

Re: Count values in multivalue field encoded as a string

zillionlee — Wed, 30 Sep 2020 01:30:24 GMT

1)
| makeresults
| eval puppy_name = "Scout Windixie Spot Spot"

| eval name_count = mvcount(mvdedup(split(puppy_name," ")))

2) it looks like a list in python, I'm not sure splunk has a function that converts a list string directly into a multi-valued field, I recommend parsing it first with a regular expression, like this:
| makeresults
| eval puppy_name ="['Scout', 'Windixie', 'Spot','Spot']"
| rex field=puppy_name "'(?P[^']+)'" max_match=0
| eval name_count = mvcount(mvdedup(name))

Hope that helps