topic Count comma delimited field in Splunk Search

Count comma delimited field

neileosis — Mon, 29 Mar 2021 20:35:13 GMT

I am trying to get counts based on comma delimited values for specified groupings of events.

For instance I have the following logs.

Event=A Ids="55,32,5" Event=A Ids="55" Event=B Ids="56,63" Event=C Ids="23,53,12" Event=C Ids="39,6"

I want the data to show up in a table like the following

Event A&B	Event C
6	5

How would I craft the query to get it to aggregate it like this?

Note: This would be happening for a large number of events.

Re: Count comma delimited field

bowesmana — Tue, 30 Mar 2021 03:46:06 GMT

This example gives you what you want - however, I have used simple logic to know that A and B need to be combined - you will have to address that grouping as you need.

This example can be pasted to the splunk search. All up to the table Ids is setting up your example data

Hope this helps

Re: Count comma delimited field

neileosis — Wed, 31 Mar 2021 20:43:06 GMT

Thanks so much! This works as needed.