Count values delimited by "," in a field

[habrhi]

Hi guys,

I have the following exemple:
Searching the "s" in Field B delimited by "," , my expected result is the following
FIELD A | FIELD B | COUNT
x | s,a,b,c | 1
y | s,x,x,xs | 2
z | s,a,s,s,s | 4

Thanks for the help

[habrhi]

thanks , that was clear .
regards

[Vijeta]

@habrhi - assuming A and B are your field names

your query |eval newB=B| makemv delim="," newB| mvexpand newB| stats count(eval(LIKE(newB,"%s%"))) as c by A B

[manjunathmeti · Accepted solution]

Use rex to extract character 's' and count it.

| rex field=_raw max_match=0 "(?[s]+)" | eval slen=mvcount(smatch)

Sample query:

| makeresults | eval "FIELD A"="x", "FIELD B"="s,a,b,c" | append [| makeresults | eval "FIELD A"="y", "FIELD B"="s,x,x,xs"] | append [| makeresults | eval "FIELD A"="z", "FIELD B"="s,a,s,s,s"] | rex field="FIELD B" max_match=0 "(?<smatch>[s]+)" | eval count=mvcount(smatch) | table "FIELD A", "FIELD B", count