Splunk Enterprise

How to count distinct values of a multi value field

shashank_24
Path Finder

Hi, I have a weird requirement where I have to count the distinct values of a multi value field. So I have a xml where a particular node can appear one time or multiple times and there are many nodes like this.

How do i count the distinct number of nodes using a request ID? Basically I am looking something like this -

request IDnodesCount
12345

networkpremise

networkdetails

mysubscription

2

3

2

3456778

networkpremise

networkdetails

mysubscription

6

2

4

And so on..  

 

Not exactly like above but if there are some other interpretations which can give a better view please let me know. I've looked into some of the posts like this but the solution has not worked for me

https://community.splunk.com/t5/Splunk-Search/Can-I-get-a-count-of-distinct-values-in-multivalue-fie...

Let me know if someone can help on this. This is my query which I was trying to do from the above referebnc

 

 

index=test_prod MyServiceGateway "SoapMessage Incoming"
| rex field=_raw "\<(?<nodes>[^\>]+)\>\s+?\<action\>" max_match=0
| rex field=_raw "\>(?<requestID>[^\<]+)\<\/ns:requestID>" max_match=0
| table requestID nodes
| untable requestID field value 
| makemv delim="," value
| mvexpand value
| stats count by requestID field value
| eval pair=value." (".count.")"
| stats list(pair) as values by requestID field

 

 

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You will need to give an example of your own data so we can help translate that to your desired output but probably something like

| stats count by requestId node
| stats list(node) as nodes list(count) as count by requestId

but that will depend somewhat on your data

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...