https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490637#M141066 <P>can you post your query?</P> Wed, 11 Mar 2020 15:08:55 GMT manjunathmeti 2020-03-11T15:08:55Z https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490634#M141063 <P>I have an event having 3 errors..<BR />I have a regular expression written to capture the error as "ERROR".<BR />And now i have a lookup file and I input the ERROR value and output Comments for the respective error.</P> <P>I do not have issues when there is just one value for ERROR field in one event(i.e., if there is only one error in a event)<BR />But when there are more than one error,then i get the result as below.<BR />Kindly help..</P> Thu, 18 Jun 2020 18:50:48 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490634#M141063 prettysunshinez 2020-06-18T18:50:48Z https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490635#M141064 <P>"ERROR" field is multivalue?</P> Wed, 11 Mar 2020 13:38:58 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490635#M141064 to4kawa 2020-03-11T13:38:58Z https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490636#M141065 <P>Single value only</P> Wed, 11 Mar 2020 14:43:43 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490636#M141065 prettysunshinez 2020-03-11T14:43:43Z https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490637#M141066 <P>can you post your query?</P> Wed, 11 Mar 2020 15:08:55 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490637#M141066 manjunathmeti 2020-03-11T15:08:55Z https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490638#M141067 <P>index= |(regular expression to catch the error from the logs as ERROR) | lookup abc.csv ERROR output Comments |stats count by Comments</P> <P>abc.csv:<BR /> ERROR Comments<BR /> Error1 abc<BR /> Error2 abc<BR /> Error3 bcd<BR /> Error4 bed<BR /> Error5 abc</P> Wed, 11 Mar 2020 16:02:21 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490638#M141067 prettysunshinez 2020-03-11T16:02:21Z https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490639#M141068 <P>Regular followed by max_match=0..<BR /> In order to capture all the occurences of ERROR</P> Wed, 11 Mar 2020 18:02:18 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490639#M141068 prettysunshinez 2020-03-11T18:02:18Z https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490640#M141069 <PRE><CODE>index=your_index |(regular expression to catch the error from the logs as ERROR) | stats count by ERROR | lookup abc.csv ERROR output Comments </CODE></PRE> <P>I see, this query excludes same <CODE>ERROR</CODE> <BR /> How about this?</P> <P>In your last comment, <CODE>|stats count by Comments</CODE><BR /> This result is following:</P> <PRE><CODE>Comments count abc 3 bcd 1 .... </CODE></PRE> <P>This result is not your <STRONG>first</STRONG> expect result.<BR /> Which do you want?</P> Wed, 11 Mar 2020 20:53:33 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490640#M141069 to4kawa 2020-03-11T20:53:33Z https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490641#M141070 <P>Am sorry I missed it..<BR /> I get the error also as part of output from lookup file..and i do statistics count and values based on ERROR..</P> Thu, 12 Mar 2020 06:01:43 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490641#M141070 prettysunshinez 2020-03-12T06:01:43Z https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490642#M141071 <P>What you are describing is not possible unless you have a <CODE>Lookup Definition</CODE> with some extra settings in it. It is pointless to continue without you spelling out everything including at least 2 lines of your <CODE>Lookup File</CODE> and your search <CODE>SPL</CODE> and your <CODE>Lookup Definition</CODE>.</P> Sat, 14 Mar 2020 20:36:53 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490642#M141071 woodcock 2020-03-14T20:36:53Z https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490643#M141072 <P>Expand ERROR values before lookup command.</P> <PRE><CODE>index= |(regular expression to catch the error from the logs as ERROR) | mvexpand ERROR | lookup abc.csv ERROR output Comments |stats count by Comments </CODE></PRE> Mon, 16 Mar 2020 10:25:36 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490643#M141072 manjunathmeti 2020-03-16T10:25:36Z https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490644#M141073 <P>Why are you being so vauge? Show us ALL of your search! The <CODE>rex</CODE> part is probably THE MOST IMPORTANT PART and yet you stripped it!?!?</P> Sun, 22 Mar 2020 18:43:53 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490644#M141073 woodcock 2020-03-22T18:43:53Z https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490645#M141074 <P>SHOW US THE FULL SEARCH SPL and a few sample events.</P> Sun, 22 Mar 2020 18:44:38 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-value-for-the-same-field-in-one-event-How-to-determine/m-p/490645#M141074 woodcock 2020-03-22T18:44:38Z