https://community.splunk.com/t5/Splunk-Search/Can-I-count-lines-in-table-cell/m-p/501566#M139636 <P>Working great, thank you!</P> Thu, 05 Dec 2019 12:35:36 GMT yossefn 2019-12-05T12:35:36Z https://community.splunk.com/t5/Splunk-Search/Can-I-count-lines-in-table-cell/m-p/501564#M139634 <P>Hi, </P> <P>I have a search to show the number of times an IP address was trying to reach some Customer IDs. <BR /> How can I count the number of CustIds and present just if there are more than 2 in a cell?</P> <P>Attached the search and results:</P> <P>original search<BR /> | stats count by CustId, IpAddress<BR /> | search count&gt;10<BR /> | sort -count<BR /> | stats list(CustId) as CustId, list(count) as Count, sum(count) as Total by IpAddress<BR /> | sort -Total<BR /> | head 10</P> <HR /> <PRE><CODE>IpAddress CustId Count Total 62.90.19.22 306352113 84 84 84.28.28.232 60555283 70 84 23070955 14 141.26.208.180 32370266 42 73 205539923 31 </CODE></PRE> Thu, 05 Dec 2019 08:08:58 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-count-lines-in-table-cell/m-p/501564#M139634 yossefn 2019-12-05T08:08:58Z https://community.splunk.com/t5/Splunk-Search/Can-I-count-lines-in-table-cell/m-p/501565#M139635 <P>Use <CODE>mvcount</CODE>. </P> <PRE><CODE>| stats count by CustId, IpAddress | search count&gt;10 | stats list(CustId) as CustId, list(count) as Count, sum(count) as Total by IpAddress | where mvcount(CustId) &gt; 1 | sort 10 - Total </CODE></PRE> Thu, 05 Dec 2019 12:01:33 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-count-lines-in-table-cell/m-p/501565#M139635 richgalloway 2019-12-05T12:01:33Z https://community.splunk.com/t5/Splunk-Search/Can-I-count-lines-in-table-cell/m-p/501566#M139636 <P>Working great, thank you!</P> Thu, 05 Dec 2019 12:35:36 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-count-lines-in-table-cell/m-p/501566#M139636 yossefn 2019-12-05T12:35:36Z