topic Re: Need to get the count of number of times a field is used in a request in Splunk Search

Need to get the count of number of times a field is used in a request

ndayanat — Sat, 13 Aug 2016 01:59:24 GMT

Need to get the count of number of times a field is used in a request

    Ex log:
    (This is a XML log, giving details from the middle and not the entire log)

Event 1: 
<students>
<student name="Raja" age="13" class="6" />
<student name="Nar" age="15" class'"8" />
<student name="Mag" age="16" class="7" />
</students>

Event 2:
<students>
<student name="Rex" age="13" class="6" />
<student name="Nanny" age="15" class'"8" />
</students>

I need to check how many times the field "Name" is used. As you can see the count varies for each event. How do I get that count?

Re: Need to get the count of number of times a field is used in a request

sundareshr — Sat, 13 Aug 2016 02:30:11 GMT

Try this

| rex max_match=0 "(?<name>name)" | eval occurrences=mvcount(name) | table name occurrences

Re: Need to get the count of number of times a field is used in a request

ndayanat — Sat, 13 Aug 2016 04:02:15 GMT

Sundareshr, Thank you for that. Can you please explain the rex and mvcount used above.

I also have one more doubt and will be more pleased if you clear that as well.
Take the Event1 from the above example. If I am filtering that alone and viewing it in splunk. Then the interesting fields has a field "name". My understanding was that it should display all the name's mentioned in the event. But it only displays the first name. for the above example it only displays Raja.

Is my understanding wrong?

Re: Need to get the count of number of times a field is used in a request

sundareshr — Sat, 13 Aug 2016 12:07:15 GMT

rex is SPL's regular expression command. I used that to extract all occurrences of the word "name" in an event. I used max_match switch to create a multi-value field with as many matches as rex finds

https://regex101.com/r/sX8wD1/1

mvcount is for counting values within multi-value fields. Here's more on that

http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Parsemultivaluefields#Evaluate_multivalue_fields

By default, field extraction will extract one occurrence. To get more than one, you either use rex with max_match or add MV_ADD in your transforms extraction. More on that here

https://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Transformsconf

Re: Need to get the count of number of times a field is used in a request

ndayanat — Mon, 27 Mar 2017 21:02:55 GMT

This was really helpful. But i have one more doubt here, we have used mvcount to get the count of that field, in case if I want to display the values for that field, what function do we use?

Ex: In event 1, there is a field called name, and if I check the values it only displays the first name of each event. ie Raja(from event 1) and Rex(from event 2). However, i want to display all the names in this field name.