Splunk Search

Splunk HELP - How to stats based on each value in array field

cheriemilk
Path Finder

Hi Team,

I have several fields which values are array. For example,

event1: ktf2="[Background_Criteria,Profile_Criteria]"
event2: ktf2="[Background_Criteria,Profile_Criteria, keyword]"
event3: ktf2="[Rating_Criteria]"

Question: How to stats based on the each element of ktf2 value??

My Expected Stats Result is:

Criteria, Count
Background_Criteria, 2
Profile_Criteria, 2
keyword, 1
Rating_Criteria, 1

1 Solution

woodcock
Esteemed Legend

The stats command is multi-value friendly as-is so just do this:

... | stats count BY ktf2

Now, assuming that the arrays are exactly as you posted and not already multi-valued fields, you can do this:

| makeresults 
| eval ktf2="[Background_Criteria,Profile_Criteria] [Background_Criteria,Profile_Criteria,keyword] [Rating_Criteria]"
| makemv ktf2
| mvexpand ktf2

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex field=ktf2 mode=sed "s/[\[\]]//g"
| eval ktf2=split(ktf2, ",")
| stats count BY ktf2

View solution in original post

0 Karma

woodcock
Esteemed Legend

The stats command is multi-value friendly as-is so just do this:

... | stats count BY ktf2

Now, assuming that the arrays are exactly as you posted and not already multi-valued fields, you can do this:

| makeresults 
| eval ktf2="[Background_Criteria,Profile_Criteria] [Background_Criteria,Profile_Criteria,keyword] [Rating_Criteria]"
| makemv ktf2
| mvexpand ktf2

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex field=ktf2 mode=sed "s/[\[\]]//g"
| eval ktf2=split(ktf2, ",")
| stats count BY ktf2
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...