I have several fields which values are array. For example,
event2: ktf2="[BackgroundCriteria,ProfileCriteria, keyword]"
Question: How to stats based on the each element of ktf2 value??
My Expected Stats Result is:
The stats command is multi-value friendly as-is so just do this:
... | stats count BY ktf2
Now, assuming that the arrays are exactly as you posted and not already multi-valued fields, you can do this:
| eval ktf2="[Background_Criteria,Profile_Criteria] [Background_Criteria,Profile_Criteria,keyword] [Rating_Criteria]"
| makemv ktf2
| mvexpand ktf2
| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"
| rex field=ktf2 mode=sed "s/[\[\]]//g"
| eval ktf2=split(ktf2, ",")
| stats count BY ktf2
View solution in original post