https://community.splunk.com/t5/Splunk-Search/How-to-count-field-with-string-and-empty-string-and-draw-a-chart/m-p/133195#M184633 <P>You can try something like this:</P> <P>| rex "email=(?<EMAIL>[^\,]*)" | eval emailtype = if(email==" ","Anonymous","Customer") | stats count by emailtype</EMAIL></P> Wed, 16 Apr 2014 11:44:26 GMT adityapavan18 2014-04-16T11:44:26Z https://community.splunk.com/t5/Splunk-Search/How-to-count-field-with-string-and-empty-string-and-draw-a-chart/m-p/133194#M184632 <P>I have below format of data. I would like to count email with empty string as anonymous and email with any string as customer and would like to draw a chart for the same.<BR /> email= ,status='yes'<BR /> email=<A href="mailto:abced@gmail.com">abced@gmail.com</A> ,status='yes'<BR /> email=<A href="mailto:ced@gmail.com">ced@gmail.com</A> ,status='yes'</P> Wed, 16 Apr 2014 10:56:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-field-with-string-and-empty-string-and-draw-a-chart/m-p/133194#M184632 annalwins 2014-04-16T10:56:31Z https://community.splunk.com/t5/Splunk-Search/How-to-count-field-with-string-and-empty-string-and-draw-a-chart/m-p/133195#M184633 <P>You can try something like this:</P> <P>| rex "email=(?<EMAIL>[^\,]*)" | eval emailtype = if(email==" ","Anonymous","Customer") | stats count by emailtype</EMAIL></P> Wed, 16 Apr 2014 11:44:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-field-with-string-and-empty-string-and-draw-a-chart/m-p/133195#M184633 adityapavan18 2014-04-16T11:44:26Z https://community.splunk.com/t5/Splunk-Search/How-to-count-field-with-string-and-empty-string-and-draw-a-chart/m-p/133196#M184634 <P>It works as I expected. <BR /> [1] Can you explain me about this rex. How does email="" string goes to Anonymous and email=äbcd.gmail.com goes to customer?<BR /> [2] How can I get avg customer from this ?</P> Thu, 17 Apr 2014 09:41:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-field-with-string-and-empty-string-and-draw-a-chart/m-p/133196#M184634 annalwins 2014-04-17T09:41:24Z https://community.splunk.com/t5/Splunk-Search/How-to-count-field-with-string-and-empty-string-and-draw-a-chart/m-p/133197#M184635 <P>Its simple, the rex i mentioned extracts everything between the string "email=" and the comma(,).<BR /> In case of proper email id's it extract email id's, but when there is no email Id there is only a blank space and that is extracted.<BR /> Now in my eval statement i am checking if email value is a blank space if yes i am setting a variable emailtype as Anonymous else as Customer. Hope that helps.</P> Thu, 17 Apr 2014 09:56:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-field-with-string-and-empty-string-and-draw-a-chart/m-p/133197#M184635 adityapavan18 2014-04-17T09:56:31Z