Hi, I have the following field called OS with 6 different values and count for each value:
Windows = 5
Mac = 4
Linux = 5
Mac, Windows = 10
Mac, Windows, Linux = 12
Mac, Linux = 11
The problem stand on that the real total of Windows values would be Windows,Windows+Mac,Windows,Linux (5+10+12)
So I would like to separate Mac,Windows into Windows and Mac values and add them to the Windows and Mac value.
At the end I would like to have something like:
Windows=27
Mac=26
Linux=16
My idea is to rename them twice but it doesn't really work out for me. Any ideas or solutions are welcome.
Cheers
Give this a try
If you have field OS only showing the OS names and not the count.
your current search giving field OS and count
| makemv OS delim="," | mvexpand OS | stats sum(count) as count by OS
If Windows = 5
is the actual full value for field OS, try this (extracting OS names and count)
your current search giving field OS with values like Windows = 5
| rex field=OS "(?<OS1>\S+)\s*\=(?<count>\d+)"
| makemv OS1 delim="," | mvexpand OS1 | stats sum(count) as count by OS1 | rename OS1 as OS
Give this a try
If you have field OS only showing the OS names and not the count.
your current search giving field OS and count
| makemv OS delim="," | mvexpand OS | stats sum(count) as count by OS
If Windows = 5
is the actual full value for field OS, try this (extracting OS names and count)
your current search giving field OS with values like Windows = 5
| rex field=OS "(?<OS1>\S+)\s*\=(?<count>\d+)"
| makemv OS1 delim="," | mvexpand OS1 | stats sum(count) as count by OS1 | rename OS1 as OS