https://community.splunk.com/t5/Splunk-Search/Search-for-events-with-multiple-field-values/m-p/37519#M8399 <P>Try mvcount()</P> <P>from the docs<BR /> mvcount(X) This function takes an field X and returns the number of values of that field if the field is multivalued, 1 if the field is single valued, and NULL otherwise.<BR /><BR /> Example: ... | eval n=mvcount(multifield)</P> Fri, 16 Aug 2013 17:25:49 GMT emotz 2013-08-16T17:25:49Z https://community.splunk.com/t5/Splunk-Search/Search-for-events-with-multiple-field-values/m-p/37518#M8398 <P>I have events that I'm joining together via transaction. Once in a transaction a field can have multiple values. How can I then search for only transactions that have more than 3 values for that field?</P> Fri, 16 Aug 2013 16:53:55 GMT https://community.splunk.com/t5/Splunk-Search/Search-for-events-with-multiple-field-values/m-p/37518#M8398 mikelanghorst 2013-08-16T16:53:55Z https://community.splunk.com/t5/Splunk-Search/Search-for-events-with-multiple-field-values/m-p/37519#M8399 <P>Try mvcount()</P> <P>from the docs<BR /> mvcount(X) This function takes an field X and returns the number of values of that field if the field is multivalued, 1 if the field is single valued, and NULL otherwise.<BR /><BR /> Example: ... | eval n=mvcount(multifield)</P> Fri, 16 Aug 2013 17:25:49 GMT https://community.splunk.com/t5/Splunk-Search/Search-for-events-with-multiple-field-values/m-p/37519#M8399 emotz 2013-08-16T17:25:49Z https://community.splunk.com/t5/Splunk-Search/Search-for-events-with-multiple-field-values/m-p/37520#M8400 <P>much cleaner than the other method I was using. Thanks!</P> Fri, 16 Aug 2013 17:39:46 GMT https://community.splunk.com/t5/Splunk-Search/Search-for-events-with-multiple-field-values/m-p/37520#M8400 mikelanghorst 2013-08-16T17:39:46Z