Splunk Search

Can i count the value for the multivalue field?

Engager

I want to count the number for the multivalue field

count(eval x=commands("search passed | search sub_areaA")) AS sub_areaAPass

is there any other way or which part of this am i wrong?

Tags (3)
0 Karma

SplunkTrust
SplunkTrust

You want to count the no of values inside the multivalued field? Look for "mvcount" command available with eval.

0 Karma

Motivator

Try using streamstats, like:

... your search ... | streamstats count(YourMultiValueField) window=1 global=f | ...rest of your search or report commands...
0 Karma

Engager

is it like this?

streamstats count(eval(status="passed"|sub_area="sub_areaA") window=1 global=f

??

or other format?

0 Karma