I have rows where data looks like..
My query (below)...
search here
| eval temp=split(FieldA,"^")
| table temp
Makes the following..
1.Value1
Value2
Value3
2.Value4
Value5
3.....
I need each value to be on a separate row. Additionally, I need the count of each time the row is returned in the event. Currently when I add "| stats count by FieldA as hits" no data is returned.
Please help!
To see every field value in separate row
search here | eval temp=split(FieldA,"^") | table temp | mvexpand temp
To get the count
search here | eval temp=split(FieldA,"^") | table temp | stats count as hits by temp
To see every field value in separate row
search here | eval temp=split(FieldA,"^") | table temp | mvexpand temp
To get the count
search here | eval temp=split(FieldA,"^") | table temp | stats count as hits by temp
I had to move "mvexpand" in front of "table", but that works. Additionally, count had to go to the end when I was trying to count, table the field and count then expand the rows. I think my order might have caused my issues. Thanks!