Splunk Search

Can i count the value for the multivalue field?

jasklee
Engager

I want to count the number for the multivalue field

count(eval x=commands("search passed | search sub_areaA")) AS sub_areaAPass

is there any other way or which part of this am i wrong?

Tags (3)
0 Karma

somesoni2
Revered Legend

You want to count the no of values inside the multivalued field? Look for "mvcount" command available with eval.

0 Karma

wpreston
Motivator

Try using streamstats, like:

... your search ... | streamstats count(YourMultiValueField) window=1 global=f | ...rest of your search or report commands...
0 Karma

jasklee
Engager

is it like this?

streamstats count(eval(status="passed"|sub_area="sub_areaA") window=1 global=f

??

or other format?

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...