topic How to count after rex multivalue? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-count-after-rex-multivalue/m-p/643818#M223032 <P>Hi,</P> <P>I am doing rex on a field that looks like this (showing multiple events below)</P> <P>a#1|b#30|c#6|d#9</P> <P>b#5|d#7|e#5|f#4</P> <P>a#6|c#4|e#9</P> <P>My rex is</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="markup">rex field=raw max_match=0 "((?&lt;service&gt;[^#]*)#(?&lt;totalRows&gt;[^\|]*)\|?)</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;Resulting into</P> <TABLE border="1" width="100%"> <TBODY> <TR> <TD width="50%">service</TD> <TD width="50%">totalRows</TD> </TR> <TR> <TD width="50%">a<BR />b<BR />c<BR />d</TD> <TD width="50%"> <P>1<BR />30<BR />6<BR />9</P> </TD> </TR> <TR> <TD width="50%">b<BR />d<BR />e<BR />f</TD> <TD width="50%">5<BR />7<BR />5<BR />4</TD> </TR> <TR> <TD width="50%">a<BR />c<BR />e</TD> <TD width="50%">6<BR />4<BR />9</TD> </TR> </TBODY> </TABLE> <P>&nbsp;</P> <P>How can I create a sum of all totalRows for each service ? Basically looking for something that will output like below</P> <TABLE border="1" width="100%"> <TBODY> <TR> <TD width="50%">service</TD> <TD width="50%">totalRows</TD> </TR> <TR> <TD width="50%">a</TD> <TD width="50%">7</TD> </TR> <TR> <TD width="50%">b</TD> <TD width="50%">35</TD> </TR> <TR> <TD width="50%">c</TD> <TD width="50%">10</TD> </TR> <TR> <TD width="50%">d</TD> <TD width="50%">16</TD> </TR> <TR> <TD width="50%">e</TD> <TD width="50%">14</TD> </TR> <TR> <TD>f</TD> <TD>4</TD> </TR> </TBODY> </TABLE> <P>&nbsp;</P> Thu, 18 May 2023 18:22:04 GMT kp3343 2023-05-18T18:22:04Z How to count after rex multivalue? https://community.splunk.com/t5/Splunk-Search/How-to-count-after-rex-multivalue/m-p/643818#M223032 <P>Hi,</P> <P>I am doing rex on a field that looks like this (showing multiple events below)</P> <P>a#1|b#30|c#6|d#9</P> <P>b#5|d#7|e#5|f#4</P> <P>a#6|c#4|e#9</P> <P>My rex is</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="markup">rex field=raw max_match=0 "((?&lt;service&gt;[^#]*)#(?&lt;totalRows&gt;[^\|]*)\|?)</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;Resulting into</P> <TABLE border="1" width="100%"> <TBODY> <TR> <TD width="50%">service</TD> <TD width="50%">totalRows</TD> </TR> <TR> <TD width="50%">a<BR />b<BR />c<BR />d</TD> <TD width="50%"> <P>1<BR />30<BR />6<BR />9</P> </TD> </TR> <TR> <TD width="50%">b<BR />d<BR />e<BR />f</TD> <TD width="50%">5<BR />7<BR />5<BR />4</TD> </TR> <TR> <TD width="50%">a<BR />c<BR />e</TD> <TD width="50%">6<BR />4<BR />9</TD> </TR> </TBODY> </TABLE> <P>&nbsp;</P> <P>How can I create a sum of all totalRows for each service ? Basically looking for something that will output like below</P> <TABLE border="1" width="100%"> <TBODY> <TR> <TD width="50%">service</TD> <TD width="50%">totalRows</TD> </TR> <TR> <TD width="50%">a</TD> <TD width="50%">7</TD> </TR> <TR> <TD width="50%">b</TD> <TD width="50%">35</TD> </TR> <TR> <TD width="50%">c</TD> <TD width="50%">10</TD> </TR> <TR> <TD width="50%">d</TD> <TD width="50%">16</TD> </TR> <TR> <TD width="50%">e</TD> <TD width="50%">14</TD> </TR> <TR> <TD>f</TD> <TD>4</TD> </TR> </TBODY> </TABLE> <P>&nbsp;</P> Thu, 18 May 2023 18:22:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-after-rex-multivalue/m-p/643818#M223032 kp3343 2023-05-18T18:22:04Z Re: How to count after rex multivalue? https://community.splunk.com/t5/Splunk-Search/How-to-count-after-rex-multivalue/m-p/643829#M223038 <P>Try something like this</P><LI-CODE lang="markup">| eval row=mvrange(0,mvcount(service)) | mvexpand row | eval service=mvindex(service, row) | eval totalRows=mvindex(totalRows, row) | stats sum(totalRows) as totalRows by service</LI-CODE> Thu, 18 May 2023 20:01:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-after-rex-multivalue/m-p/643829#M223038 ITWhisperer 2023-05-18T20:01:20Z