how to combine results after delimiting them ?

[kumudjain]

My logs contain application field which either have single value or multiple values.
I am using makemv command to delimit based on comma to separate applications when they are in multiple values as an array
but if an application for example [AML_PK2] is single in one log and is with many other applications in another log such as [AML_PK1, AML_PK2, AML_PK3] after counting for both results are like
AML_PK1 = 1
AML_PK2=1
AML_PK2 = 1
AML_PK3=1
How to combine results for aml_pk2 to show 2 counts?
My search query = index="app_web" |eval field1 = split(applications,"[") | eval field2 = split(field1,"]") | makemv delim="," field2 |search field2!=application/|search field2!=text/ |
top field2 by user countfield="No of Searches" showperc=False|rename field2 as "APPS"

[vnravikumar]

Hi @kumudjain

Please try like

yoursearchhere |
 eval output = field1 + ";" + field2 |
 makemv delim=";" output |
 mvexpand output | stats count by output

[kumudjain]

Thanks a lot for your valuable feedback 🙂

[bangalorep · Accepted solution]

This is what I tried.
| makeresults | eval a = "AML_PK1, AML_PK2, AML_PK3;AML_PK2" | makemv delim=";" a | mvexpand a | makemv delim=", " a | mvexpand a | stats count by a

[kumudjain]

Thanks it was exactly what i was looking for! 🙂

[bangalorep]

Oh great! Please accept the answer if it helped you 🙂