Splunk Enterprise

How to count distinct values of a multi value field

shashank_24
Path Finder

Hi, I have a weird requirement where I have to count the distinct values of a multi value field. So I have a xml where a particular node can appear one time or multiple times and there are many nodes like this.

How do i count the distinct number of nodes using a request ID? Basically I am looking something like this -

request IDnodesCount
12345

networkpremise

networkdetails

mysubscription

2

3

2

3456778

networkpremise

networkdetails

mysubscription

6

2

4

And so on..  

 

Not exactly like above but if there are some other interpretations which can give a better view please let me know. I've looked into some of the posts like this but the solution has not worked for me

https://community.splunk.com/t5/Splunk-Search/Can-I-get-a-count-of-distinct-values-in-multivalue-fie...

Let me know if someone can help on this. This is my query which I was trying to do from the above referebnc

 

 

index=test_prod MyServiceGateway "SoapMessage Incoming"
| rex field=_raw "\<(?<nodes>[^\>]+)\>\s+?\<action\>" max_match=0
| rex field=_raw "\>(?<requestID>[^\<]+)\<\/ns:requestID>" max_match=0
| table requestID nodes
| untable requestID field value 
| makemv delim="," value
| mvexpand value
| stats count by requestID field value
| eval pair=value." (".count.")"
| stats list(pair) as values by requestID field

 

 

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You will need to give an example of your own data so we can help translate that to your desired output but probably something like

| stats count by requestId node
| stats list(node) as nodes list(count) as count by requestId

but that will depend somewhat on your data

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...