mvcount by value

rafadvega — Thu, 18 Nov 2021 17:24:54 GMT

Hi,

I would like to count the values of a multivalue field by value. For example:

| makeresults | eval values_type=split( "value1,value2,value1,value2,value1,value2,value1,value2,value2,value2,value2,",",") | eval values_count=mvcount(values_type) | eval value1=mvfilter(match(values_type,"value1")) | eval value1_count=mvcount(value1) | eval value2_count=values_count - value1_count | table values_type message_count values_count value1_count value2_count

rafadvega_0-1637256185618.png

Is there another way to do this? For example, if I don't know the possible values, this way doesn't work.

Thanks in advance

Re: mvcount by value

ITWhisperer — Thu, 18 Nov 2021 20:08:18 GMT

| makeresults | eval values_type=split( "value1,value2,value1,value2,value1,value2,value1,value2,value2,value2,value2",",") | stats count by values_type

topic mvcount by value in Splunk Search

mvcount by value

Re: mvcount by value