count duplicate instances of multivalue field

splunkbacon — Wed, 20 Mar 2019 18:52:31 GMT

Hello.

I have events that have a field "Security_ID" that is a multi value field. It may contain something like:

NULL SID
user1

within that one field. I have found some commands to work with multivalue fields but what I am struggling with it trying to get a count.

If I have an event with Security_ID containing (user1 and NULL SID) and another event with (user2 and NULL SID) - how can I get a table that contains the stats with a count of how many times each of those combinations shows up?

ie i want a table looking like this:

Row 1: user1 NULLSID 5
Row 2: user2 NULLSID 7

Re: count duplicate instances of multivalue field

vnravikumar — Thu, 21 Mar 2019 04:27:00 GMT

Try this

| makeresults 
| eval Security_ID ="NULL SID,user1" 
| append 
    [| makeresults 
    | eval Security_ID ="NULL SID,user2"] 
| append 
    [| makeresults 
    | eval Security_ID ="NULL SID,user2"] 
| append 
    [| makeresults 
    | eval Security_ID ="NULL SID,user3"] 
| makemv delim="," Security_ID 
| eval temp =mvjoin(Security_ID,",") 
| rex field=temp "(?P<sid>.+)\,(?P<user>.+)" 
| stats count by sid, user

topic count duplicate instances of multivalue field in Splunk Search

count duplicate instances of multivalue field

Re: count duplicate instances of multivalue field