https://community.splunk.com/t5/Splunk-Search/multi-pattern-string-calculation-on-fields/m-p/197662#M57104 <P>Append this to your search:</P> <PRE><CODE>... | rex "Counts=\[(?&lt;Counts&gt;[^\]]+)\]" | eval Counts = replace(Counts, "\w+=", "") | makemv Counts delim="," | eval FormCount = mvcount(Counts) | streamstats count as eventnum | eventstats sum(Counts) as FormTotal by eventnum </CODE></PRE> Sat, 08 Nov 2014 12:20:56 GMT martin_mueller 2014-11-08T12:20:56Z https://community.splunk.com/t5/Splunk-Search/multi-pattern-string-calculation-on-fields/m-p/197661#M57103 <P>I have log coming in this format. this value is dynamic and keep changing in terms of Form and numbers<BR /> Counts=[100A=0,100B=1,100C=2,100D=1,100E=3]</P> <P>I want to first calculate how many form I have collected in this example <BR /> FormCount=5</P> <P>I want to calculate Total Form calculated <BR /> FormTotal=7</P> <P>Please let me know</P> Sat, 08 Nov 2014 09:30:43 GMT https://community.splunk.com/t5/Splunk-Search/multi-pattern-string-calculation-on-fields/m-p/197661#M57103 sumitnagal 2014-11-08T09:30:43Z https://community.splunk.com/t5/Splunk-Search/multi-pattern-string-calculation-on-fields/m-p/197662#M57104 <P>Append this to your search:</P> <PRE><CODE>... | rex "Counts=\[(?&lt;Counts&gt;[^\]]+)\]" | eval Counts = replace(Counts, "\w+=", "") | makemv Counts delim="," | eval FormCount = mvcount(Counts) | streamstats count as eventnum | eventstats sum(Counts) as FormTotal by eventnum </CODE></PRE> Sat, 08 Nov 2014 12:20:56 GMT https://community.splunk.com/t5/Splunk-Search/multi-pattern-string-calculation-on-fields/m-p/197662#M57104 martin_mueller 2014-11-08T12:20:56Z