https://community.splunk.com/t5/Splunk-Search/Splunk-HELP-How-to-stats-based-on-each-value-in-array-field/m-p/496664#M194696 <P>The <CODE>stats</CODE> command is <CODE>multi-value</CODE> friendly as-is so just do this:</P> <PRE><CODE>... | stats count BY ktf2 </CODE></PRE> <P>Now, assuming that the arrays are exactly as you posted and not already <CODE>multi-valued</CODE> fields, you can do this:</P> <PRE><CODE>| makeresults | eval ktf2="[Background_Criteria,Profile_Criteria] [Background_Criteria,Profile_Criteria,keyword] [Rating_Criteria]" | makemv ktf2 | mvexpand ktf2 | rename COMMENT AS "Everything above generates sample event data; everything below is your solution" | rex field=ktf2 mode=sed "s/[\[\]]//g" | eval ktf2=split(ktf2, ",") | stats count BY ktf2 </CODE></PRE> Wed, 04 Dec 2019 07:10:45 GMT woodcock 2019-12-04T07:10:45Z https://community.splunk.com/t5/Splunk-Search/Splunk-HELP-How-to-stats-based-on-each-value-in-array-field/m-p/496663#M194695 <P>Hi Team, </P> <P>I have several fields which values are array. For example,</P> <P>event1: ktf2="[Background_Criteria,Profile_Criteria]"<BR /> event2: ktf2="[Background_Criteria,Profile_Criteria, keyword]"<BR /> event3: ktf2="[Rating_Criteria]"</P> <P><STRONG>Question: How to stats based on the each element of ktf2 value??</STRONG></P> <P><STRONG><EM>My Expected Stats Result is:</EM></STRONG></P> <P><STRONG>Criteria, Count</STRONG><BR /> Background_Criteria, 2<BR /> Profile_Criteria, 2<BR /> keyword, 1<BR /> Rating_Criteria, 1</P> Wed, 30 Sep 2020 03:11:03 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-HELP-How-to-stats-based-on-each-value-in-array-field/m-p/496663#M194695 cheriemilk 2020-09-30T03:11:03Z https://community.splunk.com/t5/Splunk-Search/Splunk-HELP-How-to-stats-based-on-each-value-in-array-field/m-p/496664#M194696 <P>The <CODE>stats</CODE> command is <CODE>multi-value</CODE> friendly as-is so just do this:</P> <PRE><CODE>... | stats count BY ktf2 </CODE></PRE> <P>Now, assuming that the arrays are exactly as you posted and not already <CODE>multi-valued</CODE> fields, you can do this:</P> <PRE><CODE>| makeresults | eval ktf2="[Background_Criteria,Profile_Criteria] [Background_Criteria,Profile_Criteria,keyword] [Rating_Criteria]" | makemv ktf2 | mvexpand ktf2 | rename COMMENT AS "Everything above generates sample event data; everything below is your solution" | rex field=ktf2 mode=sed "s/[\[\]]//g" | eval ktf2=split(ktf2, ",") | stats count BY ktf2 </CODE></PRE> Wed, 04 Dec 2019 07:10:45 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-HELP-How-to-stats-based-on-each-value-in-array-field/m-p/496664#M194696 woodcock 2019-12-04T07:10:45Z