topic How do I find then number of elements in a comma delimited list? in Splunk Search

How do I find then number of elements in a comma delimited list?

mklunder — Sat, 14 Dec 2013 01:44:30 GMT

Given the following log entry how would a find the number of host entries and assign it to a field?

Thanks!

FINEST|1137/0|Service KOALA-MANGOES|13-12-14 00:13:35|INFO: Available nodes: [host :htti://10.0.46.107:5555 time out : 30000, host :htti://10.0.46.103:5555 time out : 30000, host :htti://10.0.46.106:5555 time out : 30000, host :htti://10.0.49.52:5555 time out : 30000, host :htti://10.0.49.176:5555 time out : 30000, host :htti://10.0.49.53:5555 time out : 30000, host :htti://10.0.39.21:5555 time out : 30000, host :htti://10.0.39.17:5555 time out : 30000, host :htti://10.0.39.19:5555 time out : 30000, host :htti://10.0.49.51:5555 time out : 30000, host :htti://10.0.39.20:5555 time out : 30000, host :htti://10.0.33.62:5555 time out : 30000, host :htti://10.0.39.18:5555 time out : 30000, host :htti://10.0.46.105:5555 time out : 30000, host :htti://10.0.50.102:5555 time out : 30000, host :htti://10.0.46.104:5555 time out : 30000, host :htti://10.0.49.54:5555 time out : 30000]

Re: How do I find then number of elements in a comma delimited list?

kristian_kolb — Sat, 14 Dec 2013 10:35:57 GMT

I would suggest that you extract the host values as a multi-valued field.

Then you can find out the number of hosts by using the mvcount() function for eval.

... | eval XXX = mvcount(servers)

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

Re: How do I find then number of elements in a comma delimited list?

mklunder — Sat, 14 Dec 2013 21:05:24 GMT

Thanks. That did the trick. I am now trying to do it in a calculated field such as

mvcount( SPLIT(nodes, ",") )

but am getting an error on the web ui. This is tracked in another question. Thanks again.