https://community.splunk.com/t5/Splunk-Search/count-of-the-exact-match/m-p/478648#M192879 <P>@prettysunshinez </P> <P>You can use <CODE>rex</CODE> command to get list of matching values in <CODE>myVal</CODE> field.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/rex">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/rex</A></P> <P>Please try this.</P> <PRE><CODE>index=YourIndex | rex max_match=0 field=_raw "(?&lt;myVal&gt;abcdef)" | eval count=mvcount(myVal) </CODE></PRE> <P>Sample:</P> <PRE><CODE>| makeresults | eval _raw="abcdef xgz mjjhj zkzkk abcdef" | rex max_match=0 field=_raw "(?&lt;myVal&gt;abcdef)" | eval count=mvcount(myVal) </CODE></PRE> <P>Here <CODE>abcdef</CODE> is sample string.</P> <P>Thanks</P> Tue, 05 Nov 2019 11:37:39 GMT kamlesh_vaghela 2019-11-05T11:37:39Z https://community.splunk.com/t5/Splunk-Search/count-of-the-exact-match/m-p/478647#M192878 <P>Hi,</P> <P>I would want to have the count of a string (say "abcdef").<BR /> sometimes the string occurs multiple times in the same event.<BR /> But stats count by host is giving me the count of events where the string is present and not the count of string present inside an event also</P> <P>Kindly help!</P> <P>Thanks...</P> Tue, 05 Nov 2019 11:21:54 GMT https://community.splunk.com/t5/Splunk-Search/count-of-the-exact-match/m-p/478647#M192878 prettysunshinez 2019-11-05T11:21:54Z https://community.splunk.com/t5/Splunk-Search/count-of-the-exact-match/m-p/478648#M192879 <P>@prettysunshinez </P> <P>You can use <CODE>rex</CODE> command to get list of matching values in <CODE>myVal</CODE> field.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/rex">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/rex</A></P> <P>Please try this.</P> <PRE><CODE>index=YourIndex | rex max_match=0 field=_raw "(?&lt;myVal&gt;abcdef)" | eval count=mvcount(myVal) </CODE></PRE> <P>Sample:</P> <PRE><CODE>| makeresults | eval _raw="abcdef xgz mjjhj zkzkk abcdef" | rex max_match=0 field=_raw "(?&lt;myVal&gt;abcdef)" | eval count=mvcount(myVal) </CODE></PRE> <P>Here <CODE>abcdef</CODE> is sample string.</P> <P>Thanks</P> Tue, 05 Nov 2019 11:37:39 GMT https://community.splunk.com/t5/Splunk-Search/count-of-the-exact-match/m-p/478648#M192879 kamlesh_vaghela 2019-11-05T11:37:39Z