Count number of occurrences inside an event

[msarro]

Hi everyone. I am working to analyze an XML output file from a vendor application we use. Inside, there is an element called <row>, and within that there can be 3 child leaves. A single output file can include several thousand of these <row> elements. How can I count the number of times <row> appears in a single event?

[cramasta · Accepted solution]

You can use rex to extract the values of each row element. You also need to use the rex setting max_match=0 (This will extract multiple values with in a single event that match the regex). You can than use the eval mvcount function to count the number of values in that extracted field.