https://community.splunk.com/t5/Splunk-Search/How-to-use-mvcount-to-get-the-accurate-count-of-a-keyword-by/m-p/485255#M135801 <P>@skakani114 ,</P> <P>Try this and test against your data</P> <PRE><CODE>index="idx" source="*TAPSSC_123.123" "CLP" |rex field=_raw max_match=0 "(?&lt;clps&gt;(?i)(CLP))"|stats count by clps </CODE></PRE> Tue, 24 Sep 2019 04:36:18 GMT renjith_nair 2019-09-24T04:36:18Z https://community.splunk.com/t5/Splunk-Search/How-to-use-mvcount-to-get-the-accurate-count-of-a-keyword-by/m-p/485254#M135800 <P>I have logs that have a keyword "*CLP" repeated multiple times in each event. I am trying the get the total counts of CLP in each event. here is the search I am using. The problem I am facing is this search is working fine with small size events but when it comes to large events with more CLP counts, the results are not accurate. please help me to get the accurate count?</P> <PRE><CODE>index="idx" source="*TAPSSC_123.123" "*CLP*" |eval tokens = lower(replace(_raw, "\W+", " ")) |makemv tokens |eval matches = mvfilter(match(tokens, "^clp$")) |eval count_CLP = mvcount(matches) |stats sum(count_CLP) as CLP_count by source </CODE></PRE> <P>Log sample: <BR /> You will see CLP keyword like that repeated multiple times in an event. <BR /> <STRONG>abvfyatfpwutnqwa25~CLP*k123456*1REF*6T*P1282158997301~AMT*c120~CLP*P11802586130*1*356612125491516</STRONG></P> Wed, 30 Sep 2020 02:15:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-mvcount-to-get-the-accurate-count-of-a-keyword-by/m-p/485254#M135800 skakani114 2020-09-30T02:15:10Z https://community.splunk.com/t5/Splunk-Search/How-to-use-mvcount-to-get-the-accurate-count-of-a-keyword-by/m-p/485255#M135801 <P>@skakani114 ,</P> <P>Try this and test against your data</P> <PRE><CODE>index="idx" source="*TAPSSC_123.123" "CLP" |rex field=_raw max_match=0 "(?&lt;clps&gt;(?i)(CLP))"|stats count by clps </CODE></PRE> Tue, 24 Sep 2019 04:36:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-mvcount-to-get-the-accurate-count-of-a-keyword-by/m-p/485255#M135801 renjith_nair 2019-09-24T04:36:18Z https://community.splunk.com/t5/Splunk-Search/How-to-use-mvcount-to-get-the-accurate-count-of-a-keyword-by/m-p/485256#M135802 <P>Thankyou so much for you help. i use this query and i am still not getting the accurate result. could you please suggest how to proceed?<BR /> is there any limits.conf to check ?</P> Wed, 25 Sep 2019 18:47:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-mvcount-to-get-the-accurate-count-of-a-keyword-by/m-p/485256#M135802 skakani114 2019-09-25T18:47:42Z