how do I count values based on many values using a multiselect filter

Talking_Master — Wed, 16 Aug 2023 09:53:21 GMT

Hi I am trying to count values based on values if they equal a range of values. Is that possible?

| search fieldName=$Token $
| stats count(eval(fieldName)) AS Label by FieldName
| table FieldName

Re: how do I count values based on many values using a multiselect filter

gcusello — Wed, 16 Aug 2023 10:01:10 GMT

one information: you used "fieldName" and "FieldName": are they two different fields or it's a mistyping?

if it's a mistyping, you can simplify your search:

| search fieldName=$Token $ | stats count AS Label by FieldName | table FieldName

if they are two different fields, you don't need to use the eval in the stats count command.

Ciao.

Giuseppe