topic Re: Count number of values in multi-valued field in Splunk Search

How to count number of values in multi-valued field?

LAcioffi — Mon, 22 Aug 2022 15:02:51 GMT

Hello!

In any event i have two fields, something like:

User - Bob
Hobbies - Singing, Dancing, Eating

The "Hobbies" field is a multivalued field, and i want the output to be something like this:

User - Bob
Hobbies_Number - 3
Hobbies - Singing, Dancing, Eating

TL;DR - Is there an easy way to count how many values are in a multivalued field and show it?

Thanks in advance!

Re: Count number of values in multi-valued field

rjthibod — Tue, 07 Feb 2017 14:24:05 GMT

use the mvcount eval function

... | eval Hobbies_Number = mvcount(Hobbies)

Re: Count number of values in multi-valued field

vijay_k — Mon, 22 Aug 2022 07:45:21 GMT

@rjthibod for mvcount should we pass token value ? should it be with $$

Re: Count number of values in multi-valued field

rjthibod — Mon, 22 Aug 2022 11:01:46 GMT

It probably depends on what the token represents.

In the original answer, the example was asking for `mvcount` against a known field name.

So, if the token you are passing is a field name and not a value of a field, then it would work.

You'd have to give more specific data about your requests to get a more confident answer, but even then, I haven't been an active Splunk dev for quite some time. So everything I say might be off.

Re: Count number of values in multi-valued field

vijay_k — Mon, 22 Aug 2022 14:12:59 GMT

<input type="multiselect" token="product_token" searchWhenChanged="true">
<label>Product types</label>
<choice value="*">All</choice>
<default>*</default>
<prefix>(</prefix>
<suffix>)</suffix>
<initialValue>*</initialValue>
<valuePrefix>DB_Product="*</valuePrefix>
<valueSuffix>*"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>DB_Product</fieldForLabel>
<fieldForValue>DB_Product</fieldForValue>
<search base="base_search_Products">
<query>|dedup DB_Product | table DB_Product</query>
</search>
</input>

This is my input multi select , thorugh which user select product Types example - All /A,B,C,D etc

I need to count, How many Product types are selcted by user . This info i need for further processing.

Re: Count number of values in multi-valued field

rjthibod — Mon, 22 Aug 2022 17:02:26 GMT

99% confident nothing like `mvcount` is going to give you that directly.

Likely have to use custom JS, or write a hidden search that will determine that and runs every time the selection for your input has changed.

I'd suggest posting this as its own question. That will get more attention than putting it in the thread of answered question.

Re: Count number of values in multi-valued field

vijay_k — Mon, 29 Aug 2022 07:33:13 GMT

thanks i will create new thread

Re: Count number of values in multi-valued field

vince2010091 — Thu, 08 Dec 2022 13:47:13 GMT

not working anymore (splunk 9.0.2)

do you have the same issue ?