topic Re: How do I get mvcount to display 0 when no field exists? in Splunk Search

How do I get mvcount to display 0 when no field exists?

DamianS — Mon, 15 Oct 2012 15:31:39 GMT

Hi all,

I have a search that looks something like this:

foo | extract pairdelim="|;]}" kvdelim="=:" mv_add=true | eval legs=mvcount(Leg)+1 | stats count by id, legs

The multi value field "Leg" has one of the 3 possible values "", "2", "2 3". I expected mvcount to work like count and when there are no values to display 0. Is there a way to display what I would I expect? Explicitly the mapping I wanted to do was from the multi value field "Leg": No Value -> 1, "2" -> 2, "2 3" -> 3

Any idea?

Re: How do I get mvcount to display 0 when no field exists?

cphair — Mon, 15 Oct 2012 17:07:31 GMT

The documentation says mvcount returns the number of values of the field if it's multivalued, 1 if it's singlevalued, and NULL otherwise. Given the mapping you describe, I think you want to do something like this:



...  | eval legs=if(isnull(Leg),1,mvcount(Leg)+1)

Re: How do I get mvcount to display 0 when no field exists?

DamianS — Tue, 16 Oct 2012 08:19:07 GMT

Perfect! Thanks for your help!

Re: How do I get mvcount to display 0 when no field exists?

cphair — Tue, 16 Oct 2012 14:14:12 GMT

You're welcome, @DamianS. Would you mind clicking the checkmark next to my answer to accept it? Thanks.