https://community.splunk.com/t5/Splunk-Search/count-of-character-in-field/m-p/50760#M12212 <P>How about something like this:</P> <PRE><CODE>sourcetype=access_combined | eval chars=mvcount(split(uri, "=")) - 1 | table uri, chars </CODE></PRE> Fri, 29 Jul 2011 20:06:14 GMT mw 2011-07-29T20:06:14Z https://community.splunk.com/t5/Splunk-Search/count-of-character-in-field/m-p/50758#M12210 <P>how would I count the number of occurances of a character or symbol in an extracted field and display that as a seperate field?</P> <P>for instance counting the number fields passed in a POST message? (delimited by <span class="lia-unicode-emoji" title=":grinning_face_with_big_eyes:">😃</span></P> <P>i have looked at rex, mvcount and stats but so far havent come up with a solution to do it from a search.</P> <P>Any ideas?</P> Fri, 29 Jul 2011 19:48:04 GMT https://community.splunk.com/t5/Splunk-Search/count-of-character-in-field/m-p/50758#M12210 EricPartington 2011-07-29T19:48:04Z https://community.splunk.com/t5/Splunk-Search/count-of-character-in-field/m-p/50759#M12211 <P>there's probably more than way to do it with the <CODE>eval</CODE> command. </P> <P><A href="http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions">http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions</A></P> <P>Here's one, if you have a field called 'postPayload': </P> <PRE><CODE>&lt;your search&gt; | eval numArgs = mvcount(split(postPayload,"="))-1 </CODE></PRE> Fri, 29 Jul 2011 19:59:49 GMT https://community.splunk.com/t5/Splunk-Search/count-of-character-in-field/m-p/50759#M12211 sideview 2011-07-29T19:59:49Z https://community.splunk.com/t5/Splunk-Search/count-of-character-in-field/m-p/50760#M12212 <P>How about something like this:</P> <PRE><CODE>sourcetype=access_combined | eval chars=mvcount(split(uri, "=")) - 1 | table uri, chars </CODE></PRE> Fri, 29 Jul 2011 20:06:14 GMT https://community.splunk.com/t5/Splunk-Search/count-of-character-in-field/m-p/50760#M12212 mw 2011-07-29T20:06:14Z