topic How to search the count of a field's values in a comma delimited list and display it as a table? in Splunk Search

How to search the count of a field's values in a comma delimited list and display it as a table?

heming277 — Wed, 13 Apr 2016 16:23:55 GMT

Hi,

I have a serious problem. I'm trying to get the counts of all the values for a field in a comma delimited list, but seems Splunk only picks up the first value, so I cannot use stats count by Fieldname to show it directly.

Part of the search is this:

&fieldA=a,b,c,d&fieldB=a,b,c,d HTTP/1.1" 200

How do I get all the counts for a, b, c, d and output the count in a table?

For example:

Field A

a 20
b 22
c 23
d 24

Please suggest a search, thanks.

Re: How to search the count of a field's values in a comma delimited list and display it as a table?

somesoni2 — Wed, 13 Apr 2016 16:51:11 GMT

Try like this (assuming the field names are fixed, e.g. fieldA fieldB etc.)

your base search | rex field=_raw "fieldA=(?<fieldA>[^&\s]+)" | makemv fieldA delim="," | stats count by fieldA

Re: How to search the count of a field's values in a comma delimited list and display it as a table?

heming277 — Wed, 13 Apr 2016 18:04:48 GMT

thank you! it seems to work