Splunk Search

Can i count the value for the multivalue field?


I want to count the number for the multivalue field

count(eval x=commands("search passed | search sub_areaA")) AS sub_areaAPass

is there any other way or which part of this am i wrong?

Tags (3)
0 Karma

Revered Legend

You want to count the no of values inside the multivalued field? Look for "mvcount" command available with eval.

0 Karma


Try using streamstats, like:

... your search ... | streamstats count(YourMultiValueField) window=1 global=f | ...rest of your search or report commands...
0 Karma


is it like this?

streamstats count(eval(status="passed"|sub_area="sub_areaA") window=1 global=f


or other format?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!