topic How to count number of values in multi-valued field , dynamically? in Splunk Search

How to count number of values in multi-valued field , dynamically?

vijay_k — Mon, 29 Aug 2022 07:36:28 GMT

<input type="multiselect" token="product_token" searchWhenChanged="true">
<label>Product types</label>
<choice value="*">All</choice>
<default>*</default>
<prefix>(</prefix>
<suffix>)</suffix>
<initialValue>*</initialValue>
<valuePrefix>DB_Product="*</valuePrefix>
<valueSuffix>*"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>DB_Product</fieldForLabel>
<fieldForValue>DB_Product</fieldForValue>
<search base="base_search_Products">
<query>|dedup DB_Product | table DB_Product</query>
</search>
</input>

This is my input multi select , thorugh which user select product Types example - All /A,B,C,D etc

I need to count, How many Product types are selcted by user . This info i need for further processing.

Re: How to count number of values in multi-valued field , dynamically?

ITWhisperer — Mon, 29 Aug 2022 08:02:27 GMT

<change> <eval token="select_count">mvcount('form.product_token')</eval> </change>

Re: How to count number of values in multi-valued field , dynamically?

vijay_k — Mon, 29 Aug 2022 09:04:41 GMT

<change>
  <eval token="select_count">mvcount('form.product_token')</eval>
</change>

</input>

I added change tag within input but it gives values NULL

Re: How to count number of values in multi-valued field , dynamically?

ITWhisperer — Mon, 29 Aug 2022 09:24:45 GMT

How are you using the token?

Re: How to count number of values in multi-valued field , dynamically?

vijay_k — Mon, 29 Aug 2022 09:29:37 GMT

index="example" source="Stash_test"|search $product_token$
|eval countn=$select_count$

Re: How to count number of values in multi-valued field , dynamically?

kamlesh_vaghela — Mon, 29 Aug 2022 15:22:50 GMT

@vijay_k

Are you looking for something like this? Just try this example.

<form version="1.1"> <label>Test</label> <fieldset submitButton="false"> <input type="multiselect" token="product_token" searchWhenChanged="true"> <label>Product types</label> <choice value="*">All</choice> <default>*</default> <prefix>(</prefix> <suffix>)</suffix> <initialValue>*</initialValue> <valuePrefix>DB_Product="*</valuePrefix> <valueSuffix>*"</valueSuffix> <delimiter> OR </delimiter> <fieldForLabel>DB_Product</fieldForLabel> <fieldForValue>DB_Product</fieldForValue> <search> <query>| makeresults count=10 | eval a=1 | accum a | eval DB_Product="DB_PR_"+a | table DB_Product</query> </search> <change> <condition match="$form.product_token$=="*""> <eval token="tmp">$form.product_token$</eval> <eval token="select_count">mvcount('form.product_token')</eval> </condition> <condition> <eval token="tmp">mvcount('form.product_token')</eval> <eval token="select_count">mvcount('form.product_token')</eval> </condition> </change> </input> </fieldset> <row> <panel> <table> <search> <query>| makeresults count=10 | eval a=1 | accum a | eval DB_Product="DB_PR_"+a | table DB_Product | search $product_token$ | eval count="$select_count$"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.