https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-occurrences-of-string-in-single-event-and/m-p/559540#M158959 <LI-CODE lang="markup">| rex max_match=0 "(?&lt;status&gt;aggrStatus)" | eval attempts=mvcount(status) | stats count by attempts</LI-CODE> Thu, 15 Jul 2021 07:33:28 GMT ITWhisperer 2021-07-15T07:33:28Z https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-occurrences-of-string-in-single-event-and/m-p/559534#M158957 <P>&nbsp;</P><P>I want to find out How many times string appeared in ONE SINGLE EVENT.<BR />and group all the events and find table like :</P><P>Attempts&nbsp; &nbsp; &nbsp; &nbsp; : Count :<BR />1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 100<BR />2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 342<BR />3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 201<BR />4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 04<BR />5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 00</P><P>how to write query for this ?<BR /><BR /><BR /></P> Mon, 19 Jul 2021 02:14:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-occurrences-of-string-in-single-event-and/m-p/559534#M158957 splunkDevendra 2021-07-19T02:14:38Z https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-occurrences-of-string-in-single-event-and/m-p/559540#M158959 <LI-CODE lang="markup">| rex max_match=0 "(?&lt;status&gt;aggrStatus)" | eval attempts=mvcount(status) | stats count by attempts</LI-CODE> Thu, 15 Jul 2021 07:33:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-occurrences-of-string-in-single-event-and/m-p/559540#M158959 ITWhisperer 2021-07-15T07:33:28Z https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-occurrences-of-string-in-single-event-and/m-p/559541#M158960 <P>Here is an example of how you can count the number of attempts.aggrStatus elements in each object</P><LI-CODE lang="markup">| makeresults | eval _raw="\"objectA\":{\"aggrStatus\":\"SUCCESS\",\"attempts\":[{\"aggrStatus\":\"FAILURE\",\"responses\":[{\"requestTime\":1626329472707,\"responseTime\":1626329474713,\"status\":\"FAILURE\"}]},{\"aggrStatus\":\"SUCCESS\",\"responses\":[{\"requestTime\":1626330378365,\"responseTime\":1626330378622,\"status\":\"SUCCESS\"}]}]}" | rex field=_raw "objectA\":(?&lt;json&gt;.*)" | spath input=json | eval attempts=mvcount('attempts{}.aggrStatus')</LI-CODE><P>assuming you have a parsed JSON object to play with - in the above I have parsed your data into JSON so I cna see the attempts.aggrStatus elements.</P><P>Then you just need to add the following to your search to get the counts</P><LI-CODE lang="markup">| stats count by attempts | sort attempts</LI-CODE><P>&nbsp;</P> Thu, 15 Jul 2021 07:36:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-occurrences-of-string-in-single-event-and/m-p/559541#M158960 bowesmana 2021-07-15T07:36:31Z https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-occurrences-of-string-in-single-event-and/m-p/559545#M158963 <P>How to minus one attempt from final table as it counts 1 extra attempt in every event</P> Thu, 15 Jul 2021 07:46:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-occurrences-of-string-in-single-event-and/m-p/559545#M158963 splunkDevendra 2021-07-15T07:46:39Z https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-occurrences-of-string-in-single-event-and/m-p/559551#M158965 <LI-CODE lang="markup">| eval attempts=mvcount(status)-1</LI-CODE> Thu, 15 Jul 2021 07:58:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-occurrences-of-string-in-single-event-and/m-p/559551#M158965 ITWhisperer 2021-07-15T07:58:19Z https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-occurrences-of-string-in-single-event-and/m-p/559555#M158968 <P>How can we show Percentage (%) of each attempt in table itself in stead of drawing different chart from same table ?</P> Thu, 15 Jul 2021 08:14:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-occurrences-of-string-in-single-event-and/m-p/559555#M158968 splunkDevendra 2021-07-15T08:14:45Z https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-occurrences-of-string-in-single-event-and/m-p/559564#M158972 <P>found following working&nbsp;</P><P>&nbsp;</P><P>| stats count as Count by attempts<BR />| eventstats sum(Count) as Total<BR />| eval perc=round((Count/Total)*100,2)<BR />| fields - Total<BR />| sort 0 - Count<BR />| head 10</P> Thu, 15 Jul 2021 09:38:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-occurrences-of-string-in-single-event-and/m-p/559564#M158972 splunkDevendra 2021-07-15T09:38:54Z