topic Re: Count of Value Pairs in URI Query String in Splunk Search https://community.splunk.com/t5/Splunk-Search/Count-of-Value-Pairs-in-URI-Query-String/m-p/53580#M13020 <PRE><CODE>... | extract auto=true | stats count by cdata </CODE></PRE> <P>Actually, unless you've done something to turn it off, the fields will usually have been auto extracted by Splunk without you having to call the <CODE>extract</CODE> command.</P> Fri, 05 Aug 2011 04:08:02 GMT gkanapathy 2011-08-05T04:08:02Z Count of Value Pairs in URI Query String https://community.splunk.com/t5/Splunk-Search/Count-of-Value-Pairs-in-URI-Query-String/m-p/53578#M13018 <P>Assuming my URL_Query field contains the following data:<BR /> <PRE><BR /> cdata=153&amp;orgid=0012<BR /> orgid=3924&amp;cdata=129<BR /> cdata=153&amp;orgid=3924<BR /> </PRE></P> <P>How can I display a table containing a unique count of value pairs cdata?<BR /> <PRE><BR /> cdata count<BR /> 153 2<BR /> 129 1<BR /> </PRE></P> Thu, 04 Aug 2011 20:34:03 GMT https://community.splunk.com/t5/Splunk-Search/Count-of-Value-Pairs-in-URI-Query-String/m-p/53578#M13018 chca 2011-08-04T20:34:03Z Re: Count of Value Pairs in URI Query String https://community.splunk.com/t5/Splunk-Search/Count-of-Value-Pairs-in-URI-Query-String/m-p/53579#M13019 <P>I also found this answer:<BR /> <A href="http://splunk-base.splunk.com/answers/8404/chart-over-query-string">http://splunk-base.splunk.com/answers/8404/chart-over-query-string</A></P> <P>However, I don't have the value pairs pre-parsed. I need to do it during the search.</P> Thu, 04 Aug 2011 20:42:40 GMT https://community.splunk.com/t5/Splunk-Search/Count-of-Value-Pairs-in-URI-Query-String/m-p/53579#M13019 chca 2011-08-04T20:42:40Z Re: Count of Value Pairs in URI Query String https://community.splunk.com/t5/Splunk-Search/Count-of-Value-Pairs-in-URI-Query-String/m-p/53580#M13020 <PRE><CODE>... | extract auto=true | stats count by cdata </CODE></PRE> <P>Actually, unless you've done something to turn it off, the fields will usually have been auto extracted by Splunk without you having to call the <CODE>extract</CODE> command.</P> Fri, 05 Aug 2011 04:08:02 GMT https://community.splunk.com/t5/Splunk-Search/Count-of-Value-Pairs-in-URI-Query-String/m-p/53580#M13020 gkanapathy 2011-08-05T04:08:02Z