Getting Data In

## Help with the logic to make this count my fields correctly

Explorer

Hi, I have the following field called OS with 6 different values and count for each value:

``````Windows = 5
Mac = 4
Linux = 5
Mac, Windows = 10
Mac, Windows, Linux = 12
Mac, Linux = 11
``````

The problem stand on that the real total of Windows values would be Windows,Windows+Mac,Windows,Linux (5+10+12)

So I would like to separate Mac,Windows into Windows and Mac values and add them to the Windows and Mac value.

At the end I would like to have something like:

``````Windows=27
Mac=26
Linux=16
``````

My idea is to rename them twice but it doesn't really work out for me. Any ideas or solutions are welcome.

Cheers

Tags (5)
1 Solution SplunkTrust

Give this a try

If you have field OS only showing the OS names and not the count.

``````your current search giving field OS and count
| makemv OS delim=","  | mvexpand OS | stats sum(count) as count by OS
``````

If `Windows = 5` is the actual full value for field OS, try this (extracting OS names and count)

``````your current search giving field OS with values like Windows = 5
| rex field=OS "(?<OS1>\S+)\s*\=(?<count>\d+)"
| makemv OS1 delim=","  | mvexpand OS1 | stats sum(count) as count by OS1 | rename OS1 as OS
`````` SplunkTrust

Give this a try

If you have field OS only showing the OS names and not the count.

``````your current search giving field OS and count
| makemv OS delim=","  | mvexpand OS | stats sum(count) as count by OS
``````

If `Windows = 5` is the actual full value for field OS, try this (extracting OS names and count)

``````your current search giving field OS with values like Windows = 5
| rex field=OS "(?<OS1>\S+)\s*\=(?<count>\d+)"
| makemv OS1 delim=","  | mvexpand OS1 | stats sum(count) as count by OS1 | rename OS1 as OS
``````  