I have a field with values like below
(a)
(a,b)
(c)
(a,c)
I am trying to parse these values, and get stats like below
a 3
b 1
c 2
Hi
you can try this
| makeresults
| eval _raw="F1
(a)
(a,b)
(c)
(a,c)"
| multikv forceheader=1
```Above generates sample data```
| rex mode=sed field=F1 "s/[\(\)]//g"
| makemv delim="," F1
| mvexpand F1
| stats count by F1
r. Ismo
Hi
you can try this
| makeresults
| eval _raw="F1
(a)
(a,b)
(c)
(a,c)"
| multikv forceheader=1
```Above generates sample data```
| rex mode=sed field=F1 "s/[\(\)]//g"
| makemv delim="," F1
| mvexpand F1
| stats count by F1
r. Ismo