https://community.splunk.com/t5/Splunk-Search/Total-counts-of-one-field-based-on-distinct-counts-of-another/m-p/280603#M84680 <P>This seems like it should be simple, but I'm new to Splunk and can't figure it out. I have one field dc(Name) that corresponds with another field that has multiple values.</P> <P>For example:</P> <P>Name: Values:<BR /> PC1 Value1, Value2, Value3<BR /> PC2 Value1, Value2, Value4<BR /> PC3 Value1, Value2</P> <P>I need to get a count of the <STRONG>total number of distinct "Values" for distinct "Names"</STRONG>. So, the sum of 3 values for PC1, 3 for PC2, 2 for PC3 etc...Keep i mind this comes from a daily DB input so the events will duplicate after every import. I looked into a few different commands but they don't seem to be working for this task.</P> <P>Thanks for any help.</P> Thu, 15 Oct 2015 03:12:48 GMT jawebb 2015-10-15T03:12:48Z https://community.splunk.com/t5/Splunk-Search/Total-counts-of-one-field-based-on-distinct-counts-of-another/m-p/280603#M84680 <P>This seems like it should be simple, but I'm new to Splunk and can't figure it out. I have one field dc(Name) that corresponds with another field that has multiple values.</P> <P>For example:</P> <P>Name: Values:<BR /> PC1 Value1, Value2, Value3<BR /> PC2 Value1, Value2, Value4<BR /> PC3 Value1, Value2</P> <P>I need to get a count of the <STRONG>total number of distinct "Values" for distinct "Names"</STRONG>. So, the sum of 3 values for PC1, 3 for PC2, 2 for PC3 etc...Keep i mind this comes from a daily DB input so the events will duplicate after every import. I looked into a few different commands but they don't seem to be working for this task.</P> <P>Thanks for any help.</P> Thu, 15 Oct 2015 03:12:48 GMT https://community.splunk.com/t5/Splunk-Search/Total-counts-of-one-field-based-on-distinct-counts-of-another/m-p/280603#M84680 jawebb 2015-10-15T03:12:48Z https://community.splunk.com/t5/Splunk-Search/Total-counts-of-one-field-based-on-distinct-counts-of-another/m-p/280604#M84681 <P>Is the field Values a multivalued field OR it's a single string with multiple values separated by comma? What is your current search?</P> Thu, 15 Oct 2015 03:31:50 GMT https://community.splunk.com/t5/Splunk-Search/Total-counts-of-one-field-based-on-distinct-counts-of-another/m-p/280604#M84681 somesoni2 2015-10-15T03:31:50Z https://community.splunk.com/t5/Splunk-Search/Total-counts-of-one-field-based-on-distinct-counts-of-another/m-p/280605#M84682 <P>Like this:</P> <PRE><CODE>... | stats values(Values) AS Values by Name | eval numValues=mvcount(Values) </CODE></PRE> Thu, 15 Oct 2015 06:20:28 GMT https://community.splunk.com/t5/Splunk-Search/Total-counts-of-one-field-based-on-distinct-counts-of-another/m-p/280605#M84682 woodcock 2015-10-15T06:20:28Z https://community.splunk.com/t5/Splunk-Search/Total-counts-of-one-field-based-on-distinct-counts-of-another/m-p/280606#M84683 <P>Thanks! That seemed to do the trick.</P> Thu, 15 Oct 2015 13:30:30 GMT https://community.splunk.com/t5/Splunk-Search/Total-counts-of-one-field-based-on-distinct-counts-of-another/m-p/280606#M84683 jawebb 2015-10-15T13:30:30Z https://community.splunk.com/t5/Splunk-Search/Total-counts-of-one-field-based-on-distinct-counts-of-another/m-p/280607#M84684 <P>Do not forget to close the question by accepting the answer.</P> Thu, 15 Oct 2015 14:34:49 GMT https://community.splunk.com/t5/Splunk-Search/Total-counts-of-one-field-based-on-distinct-counts-of-another/m-p/280607#M84684 somesoni2 2015-10-15T14:34:49Z